Analysis
- user interaction
yes - max time kernel
509s - max time network
502s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 10:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://prismlauncher.org/
Resource
win10v2004-20260513-en
General
- Target https://prismlauncher.org/
- Sample260620-mcbbkset4k
Malware Config
Signatures
- Downloads MZ/PE file 64 IoCs
flow pid Process 281 4340 chrome.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe 301 2880 prismlauncher.exe - Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation prismlauncher.exe Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation VC_redist.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation prismlauncher_updater.exe Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation javaw.exe Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation javaw.exe Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation vc_redist.x64.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 29 IoCs
pid Process 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 5660 vc_redist.x64.exe 5936 vc_redist.x64.exe 6008 VC_redist.x64.exe 3732 VC_redist.x64.exe 1624 VC_redist.x64.exe 2192 VC_redist.x64.exe 2880 prismlauncher.exe 4772 VC_redist.x64.exe 4368 prismlauncher_updater.exe 2376 prismlauncher.exe 3060 LM-Studio-0.4.16-2-x64.exe 3880 javaw.exe 1256 javaw.exe 216 javaw.exe 4224 javaw.exe 5928 javaw.exe 5872 jre-8u491-windows-i586-iftw.exe 3908 jre-8u491-windows-i586-iftw.exe 2268 LZMA_EXE 820 LZMA_EXE 5588 installer.exe 3480 javaw.exe 6004 ssvagent.exe 5432 javaws.exe 1848 jp2launcher.exe 312 javaws.exe 964 jp2launcher.exe 2852 javaw.exe - Loads dropped DLL 64 IoCs
pid Process 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 5936 vc_redist.x64.exe 2040 VC_redist.x64.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2192 VC_redist.x64.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 2880 prismlauncher.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe 4368 prismlauncher_updater.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} = "\"C:\\ProgramData\\Package Cache\\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\NoExplorer = "1" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\NoExplorer = "1" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} installer.exe -
pid Process 3704 GameBarPresenceWriter.exe - Drops file in System32 directory 54 IoCs
description ioc Process File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File created C:\Windows\SysWOW64\WindowsAccessBridge-32.dll installer.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\msvcp140.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File created C:\Windows\system32\mfc140fra.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\msvcp140_2.dll msiexec.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfc140cht.dll msiexec.exe File created C:\Windows\system32\mfc140deu.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File opened for modification C:\Windows\SysWOW64\WindowsAccessBridge-32.dll installer.exe File created C:\Windows\SysWOW64\WindowsAccessBridge-64.dll installer.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\plugin2\msvcp140.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\mlib_image.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\sunpkcs11.jar msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\verify.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\localedata.jar msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\messages_zh_TW.properties msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\asm.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-heap-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-console-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-memory-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2ssv.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\keytool.exe msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\rmiregistry.exe msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\libpng.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\giflib.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\security\blacklist msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\resources.jar msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-fibers-l1-1-1.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\pack200.exe msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\msvcp140_1.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\classlist msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\messages_fr.properties msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-interlocked-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\jfxwebkit.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\jcup.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\icu.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-core-processthreads-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\dcpr.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\kinit.exe msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\meta-index msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\fonts\LucidaSansDemiBold.ttf msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\psfontj2d.properties msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\hprof.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\joni.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\jfr\profile.jfc msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\jsoundds.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\meta-index msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\javafx\public_suffix.md msiexec.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\java8path_target_241067343\java.exe installer.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\access-bridge-32.jar msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\relaxngcc.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\ecc.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\nashorn.jar msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\fontmanager.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\w2k_lsa_auth.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\messages_zh_HK.properties msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\ext\sunmscapi.jar msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\colorimaging.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\[email protected] msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\security\java.policy msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\deploy\splash.gif msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\sspi_bridge.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\jawt.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\javafx\glib.md msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2native.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\lib\fontconfig.properties.src msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\javacpl.cpl msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\bin\instrument.dll msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\legal\jdk\dom.md msiexec.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javatmp\java.exe msiexec.exe File created C:\Program Files (x86)\Java\jre1.8.0_491\release msiexec.exe - Drops file in Windows directory 56 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI86C7.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5e5105.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8BFE.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{43B0D101-A022-48F4-9D04-BA404CEB1D53} msiexec.exe File created C:\Windows\Installer\e58e999.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8AB4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8B71.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF6B2.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI58D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8860.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{4A03706F-666A-4037-7777-5F2748764D10} msiexec.exe File opened for modification C:\Windows\Installer\MSIECAD.tmp msiexec.exe File created C:\Windows\Installer\e58e983.msi msiexec.exe File opened for modification C:\Windows\Installer\e58e984.msi msiexec.exe File created C:\Windows\Installer\SourceHash{86AB2CC9-08BD-4643-B0F9-F82D006D72FF} msiexec.exe File opened for modification C:\Windows\Installer\MSI549E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5608.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{71024AE4-039E-4CA4-87B4-2F32180491F0} msiexec.exe File created C:\Windows\Installer\e5e5105.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIEF9C.tmp msiexec.exe File created C:\Windows\Installer\e5e50fc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI533F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5350.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI557B.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e5e50fc.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI52C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI539F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI543F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI555B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5BE9.tmp msiexec.exe File created C:\Windows\Installer\e5e5100.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI87E2.tmp msiexec.exe File created C:\Windows\Installer\e58e971.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI53B0.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5A61.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A81.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5BEA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5BFB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8483.tmp msiexec.exe File created C:\Windows\Installer\e58e984.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI541F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI58D8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8745.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI89D8.tmp msiexec.exe File created C:\Windows\Installer\e5e5109.msi msiexec.exe File opened for modification C:\Windows\Sun\Java\Deployment\deployment.properties javaw.exe File opened for modification C:\Windows\Installer\e58e971.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF4AE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI53D0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI84D2.tmp msiexec.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier PrismLauncher-Windows-MSVC-Setup-11.0.2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssvagent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TaskKill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZMA_EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jp2launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZMA_EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrismLauncher-Windows-MSVC-Setup-11.0.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LM-Studio-0.4.16-2-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jp2launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vc_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jre-8u491-windows-i586-iftw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jre-8u491-windows-i586-iftw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language javaws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5588 installer.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4340 chrome.exe 4040 msedge.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Checks processor information in registry 2 TTPs 29 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msiexec.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ prismlauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz javaw.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msiexec.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 prismlauncher.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 prismlauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString prismlauncher.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Kills process with taskkill 1 IoCs
pid Process 6100 TaskKill.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppName = "ssvagent.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin" installer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\ACTIVEX COMPATIBILITY\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\Compatibility Flags = "1024" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "0" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppName = "jp2launcher.exe" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\Policy = "3" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}\Policy = "3" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName = "javaws.exe" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9167671E-7E42-49E1-97FC-4F4712EB4CEE}\AppPath = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\AppName = "jp2launcher.exe" installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7}\Policy = "3" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA}\AlternateCLSID = "{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA}" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4b5f-9EE6-34795C46E7E7} installer.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0047-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0442-ABCDEFFEDCBC}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0094-ABCDEFFEDCBC} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0216-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0077-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0026-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0104-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0443-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0089-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0238-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0333-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBA} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_18" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0162-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0088-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0016-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_16" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0049-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0324-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0018-0000-0449-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0391-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0483-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_483" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0226-ABCDEFFEDCBC} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0013-0001-0063-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0070-ABCDEFFEDCBB}\ = "Java Plug-in 1.5.0_70" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0409-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0342-ABCDEFFEDCBC}\InprocServer32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0015-0000-0049-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0093-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0015-0000-0065-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0186-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0436-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0479-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_479" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0257-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0333-ABCDEFFEDCBB}\ = "Java Plug-in 1.8.0_333" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0257-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0356-ABCDEFFEDCBB} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0254-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0308-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0195-ABCDEFFEDCBC}\INPROCSERVER32 installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0002-0068-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0179-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0342-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0377-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_377" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0211-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0017-0000-0358-ABCDEFFEDCBB}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0414-ABCDEFFEDCBB} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0059-ABCDEFFEDCBC} installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0057-ABCDEFFEDCBC} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0085-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0218-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0273-ABCDEFFEDCBB} installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0462-ABCDEFFEDCBC}\ = "Java Plug-in 1.8.0_462" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0348-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_348" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0013-0001-0078-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0097-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0016-0000-0168-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0157-ABCDEFFEDCBC}\ = "Java Plug-in 1.7.0_157" installer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0017-0000-0454-ABCDEFFEDCBA} installer.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\CLSID\{CAFEEFAC-0016-0000-0214-ABCDEFFEDCBA}\INPROCSERVER32 installer.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\CLSID\{CAFEEFAC-0018-0000-0127-ABCDEFFEDCBB} installer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0199-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0345-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0079-ABCDEFFEDCBC}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0057-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0081-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0095-ABCDEFFEDCBA}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBA}\ = "Java Plug-in 1.7.0_71" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0494-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0071-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0438-ABCDEFFEDCBA} installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0018-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0237-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_237" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0340-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0496-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0358-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0451-ABCDEFFEDCBB}\InprocServer32 installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0071-ABCDEFFEDCBA}\ = "Java Plug-in 1.3.1_71" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0270-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_270" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0478-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0147-ABCDEFFEDCBB}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0225-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0250-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0432-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0284-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_284" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0288-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0296-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBB}\ = "Java Plug-in 1.4.2_03" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0131-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0305-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0242-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_242" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0039-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0061-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0376-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0086-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0469-ABCDEFFEDCBB}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0084-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0395-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0064-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0111-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBA}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0207-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_207" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0460-ABCDEFFEDCBC}\InprocServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0081-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0445-ABCDEFFEDCBA}\InprocServer32 installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0099-ABCDEFFEDCBB} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0381-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0043-ABCDEFFEDCBB}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0217-ABCDEFFEDCBA}\ = "Java Plug-in 1.8.0_217" ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0343-ABCDEFFEDCBC} ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0324-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0326-ABCDEFFEDCBB} ssvagent.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0124-ABCDEFFEDCBA} ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0250-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0036-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0015-0000-0067-ABCDEFFEDCBA}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}\InprocServer32\ThreadingModel = "Apartment" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0383-ABCDEFFEDCBB}\ = "Java Plug-in 1.7.0_383" installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0018-0000-0478-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" installer.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0013-0001-0067-ABCDEFFEDCBA}\InprocServer32 ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0150-ABCDEFFEDCBC}\InprocServer32\ThreadingModel = "Apartment" ssvagent.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0197-ABCDEFFEDCBC}\InprocServer32\ = "C:\\Program Files (x86)\\Java\\jre1.8.0_491\\bin\\jp2iexp.dll" ssvagent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAFEEFAC-0017-0000-0058-ABCDEFFEDCBA}\InprocServer32 installer.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe:Zone.Identifier PrismLauncher-Windows-MSVC-Setup-11.0.2.exe - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 2880 prismlauncher.exe 4368 prismlauncher_updater.exe 2376 prismlauncher.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2616 msiexec.exe 2616 msiexec.exe 2616 msiexec.exe 2616 msiexec.exe 2616 msiexec.exe 2616 msiexec.exe 2616 msiexec.exe 2616 msiexec.exe 4556 msedge.exe 4556 msedge.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 3048 chrome.exe 3048 chrome.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 1256 javaw.exe 5812 msiexec.exe 5812 msiexec.exe 5432 javaws.exe 5432 javaws.exe 1848 jp2launcher.exe 1848 jp2launcher.exe 312 javaws.exe 312 javaws.exe 964 jp2launcher.exe 964 jp2launcher.exe 5812 msiexec.exe 5812 msiexec.exe 5812 msiexec.exe 5812 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2880 prismlauncher.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
pid Process 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 6100 TaskKill.exe Token: SeBackupPrivilege 5192 vssvc.exe Token: SeRestorePrivilege 5192 vssvc.exe Token: SeAuditPrivilege 5192 vssvc.exe Token: SeShutdownPrivilege 6008 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 6008 VC_redist.x64.exe Token: SeSecurityPrivilege 2616 msiexec.exe Token: SeCreateTokenPrivilege 6008 VC_redist.x64.exe Token: SeAssignPrimaryTokenPrivilege 6008 VC_redist.x64.exe Token: SeLockMemoryPrivilege 6008 VC_redist.x64.exe Token: SeIncreaseQuotaPrivilege 6008 VC_redist.x64.exe Token: SeMachineAccountPrivilege 6008 VC_redist.x64.exe Token: SeTcbPrivilege 6008 VC_redist.x64.exe Token: SeSecurityPrivilege 6008 VC_redist.x64.exe Token: SeTakeOwnershipPrivilege 6008 VC_redist.x64.exe Token: SeLoadDriverPrivilege 6008 VC_redist.x64.exe Token: SeSystemProfilePrivilege 6008 VC_redist.x64.exe Token: SeSystemtimePrivilege 6008 VC_redist.x64.exe Token: SeProfSingleProcessPrivilege 6008 VC_redist.x64.exe Token: SeIncBasePriorityPrivilege 6008 VC_redist.x64.exe Token: SeCreatePagefilePrivilege 6008 VC_redist.x64.exe Token: SeCreatePermanentPrivilege 6008 VC_redist.x64.exe Token: SeBackupPrivilege 6008 VC_redist.x64.exe Token: SeRestorePrivilege 6008 VC_redist.x64.exe Token: SeShutdownPrivilege 6008 VC_redist.x64.exe Token: SeDebugPrivilege 6008 VC_redist.x64.exe Token: SeAuditPrivilege 6008 VC_redist.x64.exe Token: SeSystemEnvironmentPrivilege 6008 VC_redist.x64.exe Token: SeChangeNotifyPrivilege 6008 VC_redist.x64.exe Token: SeRemoteShutdownPrivilege 6008 VC_redist.x64.exe Token: SeUndockPrivilege 6008 VC_redist.x64.exe Token: SeSyncAgentPrivilege 6008 VC_redist.x64.exe Token: SeEnableDelegationPrivilege 6008 VC_redist.x64.exe Token: SeManageVolumePrivilege 6008 VC_redist.x64.exe Token: SeImpersonatePrivilege 6008 VC_redist.x64.exe Token: SeCreateGlobalPrivilege 6008 VC_redist.x64.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 5936 vc_redist.x64.exe 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 2192 VC_redist.x64.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe 644 chrome.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1256 javaw.exe 1256 javaw.exe 1580 OpenWith.exe 5928 javaw.exe 5928 javaw.exe 5928 javaw.exe 5928 javaw.exe 3908 jre-8u491-windows-i586-iftw.exe 3908 jre-8u491-windows-i586-iftw.exe 3908 jre-8u491-windows-i586-iftw.exe 3908 jre-8u491-windows-i586-iftw.exe 1848 jp2launcher.exe 964 jp2launcher.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 368 4956 msedge.exe 86 PID 4956 wrote to memory of 3140 4956 msedge.exe 87 PID 4956 wrote to memory of 4040 4956 msedge.exe 88 PID 4956 wrote to memory of 3140 4956 msedge.exe 87 PID 4956 wrote to memory of 3140 4956 msedge.exe 87 PID 4956 wrote to memory of 3328 4956 msedge.exe 90 PID 4956 wrote to memory of 3328 4956 msedge.exe 90 PID 4956 wrote to memory of 2376 4956 msedge.exe 91 PID 4956 wrote to memory of 2376 4956 msedge.exe 91 PID 4956 wrote to memory of 2376 4956 msedge.exe 91 PID 4956 wrote to memory of 4960 4956 msedge.exe 92 PID 4956 wrote to memory of 4960 4956 msedge.exe 92 PID 4956 wrote to memory of 4960 4956 msedge.exe 92 PID 4956 wrote to memory of 2888 4956 msedge.exe 93 PID 4956 wrote to memory of 2888 4956 msedge.exe 93 PID 4956 wrote to memory of 2888 4956 msedge.exe 93 PID 4956 wrote to memory of 4232 4956 msedge.exe 94 PID 4956 wrote to memory of 4232 4956 msedge.exe 94 PID 4956 wrote to memory of 4232 4956 msedge.exe 94 PID 4956 wrote to memory of 4136 4956 msedge.exe 100 PID 4956 wrote to memory of 4752 4956 msedge.exe 101 PID 4956 wrote to memory of 4136 4956 msedge.exe 100 PID 4956 wrote to memory of 4752 4956 msedge.exe 101 PID 4956 wrote to memory of 2420 4956 msedge.exe 105 PID 4956 wrote to memory of 1648 4956 msedge.exe 108 PID 4956 wrote to memory of 1648 4956 msedge.exe 108 PID 4956 wrote to memory of 1648 4956 msedge.exe 108 PID 4956 wrote to memory of 3552 4956 msedge.exe 109 PID 4956 wrote to memory of 2148 4956 msedge.exe 110 PID 4956 wrote to memory of 3552 4956 msedge.exe 109 PID 4956 wrote to memory of 2148 4956 msedge.exe 110 PID 4956 wrote to memory of 2148 4956 msedge.exe 110 PID 4956 wrote to memory of 4592 4956 msedge.exe 112 PID 4956 wrote to memory of 4592 4956 msedge.exe 115 PID 4592 wrote to memory of 6100 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 123 PID 4592 wrote to memory of 5660 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 125 PID 4956 wrote to memory of 5756 4956 msedge.exe 126 PID 4956 wrote to memory of 5712 4956 msedge.exe 127 PID 4956 wrote to memory of 5656 4956 msedge.exe 128 PID 5660 wrote to memory of 5936 5660 vc_redist.x64.exe 130 PID 5936 wrote to memory of 6008 5936 vc_redist.x64.exe 131 PID 3732 wrote to memory of 1624 3732 VC_redist.x64.exe 142 PID 1624 wrote to memory of 2192 1624 VC_redist.x64.exe 143 PID 6008 wrote to memory of 4624 6008 VC_redist.x64.exe 145 PID 4624 wrote to memory of 2040 4624 VC_redist.x64.exe 146 PID 2040 wrote to memory of 4360 2040 VC_redist.x64.exe 147 PID 4592 wrote to memory of 2880 4592 PrismLauncher-Windows-MSVC-Setup-11.0.2.exe 149 PID 2192 wrote to memory of 4772 2192 VC_redist.x64.exe 150 PID 4956 wrote to memory of 5912 4956 msedge.exe 153 PID 4956 wrote to memory of 5912 4956 msedge.exe 153 PID 2880 wrote to memory of 4368 2880 prismlauncher.exe 154 PID 4368 wrote to memory of 2376 4368 prismlauncher_updater.exe 155 PID 4956 wrote to memory of 4556 4956 msedge.exe 158 PID 644 wrote to memory of 5572 644 chrome.exe 161 PID 644 wrote to memory of 4340 644 chrome.exe 162 PID 644 wrote to memory of 1616 644 chrome.exe 163 PID 644 wrote to memory of 1616 644 chrome.exe 163 PID 644 wrote to memory of 3740 644 chrome.exe 164 PID 644 wrote to memory of 3740 644 chrome.exe 164 PID 644 wrote to memory of 4532 644 chrome.exe 166 PID 644 wrote to memory of 1208 644 chrome.exe 167 PID 644 wrote to memory of 4532 644 chrome.exe 166 PID 644 wrote to memory of 1208 644 chrome.exe 167 PID 644 wrote to memory of 4360 644 chrome.exe 168 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://prismlauncher.org/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcedecc188,0x7ffcedecc194,0x7ffcedecc1a02⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,11118493814262863,6921624824601830118,262144 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:22⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10498545640429673369,546073820930035996,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:32⤵
- System Time Discovery
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,14097797074980890483,3779446288663284377,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,14173484756429047437,6744943182847669324,2097152 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:2376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,8292157086658046864,9374580120007924877,2097152 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,93782588609487486,10134582037126649589,2097152 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:12⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,12581841784742011391,11742708107747349279,2097152 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:22⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12030545933434780960,15209777180037256725,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:82⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,11022729640519116534,12880804769840787132,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:4752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12390988848450737007,14763835156794141582,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12390988848450737007,14763835156794141582,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:82⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6180,i,3223294483460362603,12041299842728465093,2097152 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:12⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,17653174664995771766,6188860411969209555,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:82⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4244,i,15952339969022669887,15493565511832053524,2097152 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,12044068472273470958,15727076972810118695,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:82⤵PID:4592
-
-
C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Setup-11.0.2.exe"C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Setup-11.0.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\TaskKill.exeTaskKill /IM prismlauncher.exe /F3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6100
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe /install /passive /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\Temp\{04035DB3-336F-49E3-B0B0-0675EBA7B4F7}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{04035DB3-336F-49E3-B0B0-0675EBA7B4F7}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe" -burn.filehandle.attached=796 -burn.filehandle.self=804 /install /passive /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\.be\VC_redist.x64.exe"C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4C47C698-9BDA-4D88-A8E0-7CC0023183AB} {843DDC9B-3C79-4634-84FE-DDBF51BB1F5F} 59365⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{9FC5AA8B-A62A-4E12-8777-96B5DE1A8580} {3A4515E4-A865-4BAC-AC71-CDDDE05D9ED8} 60086⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=652 -burn.filehandle.self=672 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1108 -burn.embedded BurnPipe.{9FC5AA8B-A62A-4E12-8777-96B5DE1A8580} {3A4515E4-A865-4BAC-AC71-CDDDE05D9ED8} 60087⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5B60EE05-88BD-4470-9430-B162399CB071} {C540AF5A-485C-4217-A7CD-8B8E9174D65F} 20408⤵
- System Location Discovery: System Language Discovery
PID:4360
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe"3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher_updater.exe --check-only --dir C:/Users/Admin/AppData/Roaming/PrismLauncher --debug4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exeC:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe --version5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2376
-
-
-
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -jar C:/Users/Admin/AppData/Local/Programs/PrismLauncher/jars/JavaCheck.jar4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3880
-
-
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -Duser.language=en -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms512m -Xmx4096m "-Djava.library.path=C:/Users/Admin/AppData/Roaming/PrismLauncher/instances/Fabulously Optimized/natives" -cp C:/Users/Admin/AppData/Local/Programs/PrismLauncher/jars/NewLaunch.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows-arm64/3.4.1/lwjgl-freetype-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows-x86/3.4.1/lwjgl-freetype-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype-natives-windows/3.4.1/lwjgl-freetype-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-freetype/3.4.1/lwjgl-freetype-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows-arm64/3.4.1/lwjgl-glfw-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows-x86/3.4.1/lwjgl-glfw-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw-natives-windows/3.4.1/lwjgl-glfw-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-glfw/3.4.1/lwjgl-glfw-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-arm64/3.4.1/lwjgl-jemalloc-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-x86/3.4.1/lwjgl-jemalloc-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows/3.4.1/lwjgl-jemalloc-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-jemalloc/3.4.1/lwjgl-jemalloc-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows-arm64/3.4.1/lwjgl-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows-x86/3.4.1/lwjgl-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-natives-windows/3.4.1/lwjgl-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows-arm64/3.4.1/lwjgl-openal-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows-x86/3.4.1/lwjgl-openal-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal-natives-windows/3.4.1/lwjgl-openal-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-openal/3.4.1/lwjgl-openal-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows-arm64/3.4.1/lwjgl-opengl-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows-x86/3.4.1/lwjgl-opengl-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl-natives-windows/3.4.1/lwjgl-opengl-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-opengl/3.4.1/lwjgl-opengl-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc-natives-windows-arm64/3.4.1/lwjgl-shaderc-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc-natives-windows-x86/3.4.1/lwjgl-shaderc-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc-natives-windows/3.4.1/lwjgl-shaderc-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-shaderc/3.4.1/lwjgl-shaderc-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc-natives-windows-arm64/3.4.1/lwjgl-spvc-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc-natives-windows-x86/3.4.1/lwjgl-spvc-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc-natives-windows/3.4.1/lwjgl-spvc-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-spvc/3.4.1/lwjgl-spvc-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows-arm64/3.4.1/lwjgl-stb-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows-x86/3.4.1/lwjgl-stb-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb-natives-windows/3.4.1/lwjgl-stb-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-stb/3.4.1/lwjgl-stb-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-arm64/3.4.1/lwjgl-tinyfd-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-x86/3.4.1/lwjgl-tinyfd-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows/3.4.1/lwjgl-tinyfd-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-tinyfd/3.4.1/lwjgl-tinyfd-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma-natives-windows-arm64/3.4.1/lwjgl-vma-natives-windows-arm64-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma-natives-windows-x86/3.4.1/lwjgl-vma-natives-windows-x86-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma-natives-windows/3.4.1/lwjgl-vma-natives-windows-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vma/3.4.1/lwjgl-vma-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl-vulkan/3.4.1/lwjgl-vulkan-3.4.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/lwjgl/lwjgl/3.4.1/lwjgl-3.4.1-unsafe.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/at/yawk/lz4/lz4-java/1.10.1/lz4-java-1.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/azure/azure-json/1.4.0/azure-json-1.4.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/oshi/oshi-core/6.9.0/oshi-core-6.9.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/code/gson/gson/2.14.0/gson-2.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/guava/failureaccess/1.0.3/failureaccess-1.0.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/guava/guava/33.6.0-jre/guava-33.6.0-jre.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/ibm/icu/icu4j/78.3/icu4j-78.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/microsoft/azure/msal4j/1.24.1/msal4j-1.24.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/authlib/9.0.75/authlib-9.0.75.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/brigadier/1.3.10/brigadier-1.3.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/datafixerupper/10.0.21/datafixerupper-10.0.21.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/jtracy/1.0.37/jtracy-1.0.37.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/jtracy-natives-windows/1.0.37/jtracy-natives-windows-1.0.37.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/logging/1.7.12/logging-1.7.12.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/text2speech/1.19.12/text2speech-1.19.12.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-codec/commons-codec/1.22.0/commons-codec-1.22.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-buffer/4.2.15.Final/netty-buffer-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec-base/4.2.15.Final/netty-codec-base-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec-compression/4.2.15.Final/netty-codec-compression-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-codec-http/4.2.15.Final/netty-codec-http-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-common/4.2.15.Final/netty-common-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-handler/4.2.15.Final/netty-handler-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-resolver/4.2.15.Final/netty-resolver-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-classes-epoll/4.2.15.Final/netty-transport-classes-epoll-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-classes-kqueue/4.2.15.Final/netty-transport-classes-kqueue-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport-native-unix-common/4.2.15.Final/netty-transport-native-unix-common-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/io/netty/netty-transport/4.2.15.Final/netty-transport-4.2.15.Final.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/it/unimi/dsi/fastutil/8.5.18/fastutil-8.5.18.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna-platform/5.17.0/jna-platform-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna/5.17.0/jna-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/commons/commons-compress/1.28.0/commons-compress-1.28.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/commons/commons-lang3/3.20.0/commons-lang3-3.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-api/2.26.0/log4j-api-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-core/2.26.0/log4j-core-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-slf4j2-impl/2.26.0/log4j-slf4j2-impl-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/jcraft/jorbis/0.0.17/jorbis-0.0.17.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/joml/joml/1.10.8/joml-1.10.8.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/slf4j/slf4j-api/2.0.17/slf4j-api-2.0.17.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/fabricmc/intermediary/26.2/intermediary-26.2.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm/9.10.1/asm-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-analysis/9.10.1/asm-analysis-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-commons/9.10.1/asm-commons-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-tree/9.10.1/asm-tree-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/ow2/asm/asm-util/9.10.1/asm-util-9.10.1.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/fabricmc/sponge-mixin/0.17.3+mixin.0.8.7/sponge-mixin-0.17.3+mixin.0.8.7.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/fabricmc/fabric-loader/0.19.3/fabric-loader-0.19.3.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/mojang/minecraft/26.2/minecraft-26.2-client.jar org.prismlauncher.EntryPoint4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1256 -
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -XX:+UseSerialGC -XX:MaxHeapFreeRatio=30 -XX:MinHeapFreeRatio=10 -XX:MaxGCPauseMillis=10000 -Xms8m -Xmx512m -cp local\crash_assistant\1256_1781951005300_app.jar;local\crash_assistant\1256_1781951005300_mod.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/oshi/oshi-core/6.9.0/oshi-core-6.9.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/code/gson/gson/2.14.0/gson-2.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna-platform/5.17.0/jna-platform-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna/5.17.0/jna-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-api/2.26.0/log4j-api-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-core/2.26.0/log4j-core-2.26.0.jar dev.kostromdan.mods.crash_assistant.app.class_loading.Boot --args-file local\crash_assistant\1256_1781951005300_args.info5⤵
- Executes dropped EXE
- Checks processor information in registry
PID:216 -
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -XX:+UseSerialGC -XX:MaxHeapFreeRatio=30 -XX:MinHeapFreeRatio=10 -XX:MaxGCPauseMillis=10000 -Xms8m -Xmx512m -cp local\crash_assistant\1256_1781951005300_app.jar;local\crash_assistant\1256_1781951005300_mod.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/oshi/oshi-core/6.9.0/oshi-core-6.9.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/code/gson/gson/2.14.0/gson-2.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna-platform/5.17.0/jna-platform-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna/5.17.0/jna-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-api/2.26.0/log4j-api-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-core/2.26.0/log4j-core-2.26.0.jar dev.kostromdan.mods.crash_assistant.app.class_loading.Boot --args-file local\crash_assistant\1256_1781951005300_args.info -gpuDetect6⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4224
-
-
C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exeC:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\bin\javaw.exe -XX:+UseSerialGC -XX:MaxHeapFreeRatio=30 -XX:MinHeapFreeRatio=10 -XX:MaxGCPauseMillis=10000 -Xms8m -Xmx512m -cp local\crash_assistant\1256_1781951005300_app.jar;local\crash_assistant\1256_1781951005300_mod.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/github/oshi/oshi-core/6.9.0/oshi-core-6.9.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/com/google/code/gson/gson/2.14.0/gson-2.14.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/commons-io/commons-io/2.20.0/commons-io-2.20.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna-platform/5.17.0/jna-platform-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/net/java/dev/jna/jna/5.17.0/jna-5.17.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-api/2.26.0/log4j-api-2.26.0.jar;C:/Users/Admin/AppData/Roaming/PrismLauncher/libraries/org/apache/logging/log4j/log4j-core/2.26.0/log4j-core-2.26.0.jar dev.kostromdan.mods.crash_assistant.app.class_loading.Boot --args-file local\crash_assistant\1256_1781951005300_args.info -recursiveStart6⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5928
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,6458184900417831384,13788345968418038291,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:82⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,3711599130919205508,877605689748609967,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:82⤵PID:5712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,6524862391099908824,1293797712656726113,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:82⤵PID:5656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,6867105056747737915,8222454012065097196,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:82⤵PID:5912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,4697743377239214839,12848396217402333214,262144 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12151427700620658470,9741294964281600333,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,10558014050636529177,6693105351566935261,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:82⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,4908325041313345928,14187604567221666670,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:82⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,4031784479139098410,15621121250017252922,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:6024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8186795896537820966,10174765010264709089,524288 --field-trial-handle=2428,i,1105703120529327624,11833135667368332981,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:82⤵PID:416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4292
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5192
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:3812
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620111921.log" /install2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620111921.log" /install3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6F58AC13-F166-48F8-B31A-CFF70AC727AE} {B1706C58-D3B9-4C72-A2D2-9E212794C241} 21924⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4772
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffceb30c728,0x7ffceb30c734,0x7ffceb30c7402⤵PID:5572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,2384261702363184530,12951086921884254404,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2128 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,990949901085390483,7965967473952715139,262144 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2032 /prefetch:22⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2444,i,12169018036765167459,1424226045171065788,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:3740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,17952287684691600928,3957509396193258262,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,11466260879005765472,12495962867053296443,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,6898194120081124040,11088447571818496838,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3928,i,5024480337886113964,9054379427756991500,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4556 /prefetch:82⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4728,i,8084460974251131889,12882145683397234294,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4876 /prefetch:82⤵PID:5392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,6892271058375705873,14346538945279254405,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5264 /prefetch:82⤵PID:692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5588,i,7491047348559381406,8863717794536599968,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3340,i,13610365569619633086,5749389245336380965,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5724 /prefetch:12⤵PID:6056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3500,i,4288730934428250279,11660376468544110871,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,15140650994708278800,10233862488407854309,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:82⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,10515644480330493364,1770218430228767492,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:82⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,16029813188080416004,1210584801149692810,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5864 /prefetch:82⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,10712844130477778304,5486749064837779186,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:5476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5584,i,7163874360764290061,3075652667163046489,262144 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,10178903858244621928,5421050151854040105,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4620 /prefetch:82⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6132,i,15564973222339343726,813717132094589647,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5956,i,12003848818159609324,13293082719979762571,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:12⤵PID:5768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3216,i,1089635582265503123,12048074559900779550,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:6028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6248,i,3592507677512426911,2887503483957402568,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6256 /prefetch:12⤵PID:5812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5364,i,7535672044567442329,17445546386620913650,2097152 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6416 /prefetch:12⤵PID:5740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,6173921281396962023,17552324922212250569,524288 --field-trial-handle=2036,i,5728056570593546432,3967432942060410192,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6260 /prefetch:82⤵PID:5268
-
-
C:\Users\Admin\Downloads\jre-8u491-windows-i586-iftw.exe"C:\Users\Admin\Downloads\jre-8u491-windows-i586-iftw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\jds241035062.tmp\jre-8u491-windows-i586-iftw.exe"C:\Users\Admin\AppData\Local\Temp\jds241035062.tmp\jre-8u491-windows-i586-iftw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3908 -
C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE"C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\au.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\msi.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268
-
-
C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE"C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\LZMA_EXE" d "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\jre1.8.0_491.msi" "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\msi.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820
-
-
C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files (x86)\Java\jre1.8.0_491\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2852
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2184
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2940
-
C:\Users\Admin\Downloads\LM-Studio-0.4.16-2-x64.exe"C:\Users\Admin\Downloads\LM-Studio-0.4.16-2-x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x1501⤵PID:5972
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2560
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
PID:3704
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:4416
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5812 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C4281D223C1E18C42FAFF8CA26A563202⤵
- System Location Discovery: System Language Discovery
PID:3512
-
-
C:\Program Files (x86)\Java\jre1.8.0_491\installer.exe"C:\Program Files (x86)\Java\jre1.8.0_491\installer.exe" /s INSTALLDIR="C:\Program Files (x86)\Java\jre1.8.0_491\\" WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F32180491F0} TMPPINGFILE=C:\Users\Admin\AppData\Local\Temp\jdsping241035343.tmp2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5588 -
C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe"C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3480
-
-
C:\Program Files (x86)\Java\jre1.8.0_491\bin\ssvagent.exe"C:\Program Files (x86)\Java\jre1.8.0_491\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6004
-
-
C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5432 -
C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_491" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80OTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1848
-
-
-
C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe"C:\Program Files (x86)\Java\jre1.8.0_491\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:312 -
C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe"C:\Program Files (x86)\Java\jre1.8.0_491\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files (x86)\Java\jre1.8.0_491" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXMgKHg4NilcSmF2YVxqcmUxLjguMF80OTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxKYXZhXGpyZTEuOC4wXzQ5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzICh4ODYpXEphdmFcanJlMS44LjBfNDkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:964
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 27DDF3EFE86E3FBEC23869B0E7DC66D9 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:1580
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8AC2DABCD5282C9209A2821FE38AA0BC2⤵
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 263F88C67DB6471B044EE50BE6F57124 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:4256
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BC54FBE6CC5B514682459357524BEBDC2⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F999C3E338C3DD2C24D3070AB4CAA1E7 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
PID:3736
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:1580
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58e976.rbs
- Size 19KB
- SHA256 4d3c578fcaa7fc1e63f1c89d62134a77440a7462b0ad782bae17fcdd7662617c
- MD5 1f053e8caa9ef283802ff06a0383dad5
- SHA1 a0c4fd299cff47bcae109b019fd19bc595273acc
- SHA512 916bc67703ca55fd9d73a581c78359e59c5e8454feaedbbef0d64eeb46cdecd3c54c3680a477546b057cf15abe0d454cb6dd4b3b720d2c5db1fcd179cdeeb5b4
- SSDEEP 192:/NRF1kR815dXcFUADIc1L+W+y4+agPu8/Ok7:/NRF6R8TeC81L/c4b7
- TLSH T17392FC527A90C9D2D8766B30CD631BA53BB6DBD5A350438B50DC90308F93BCA2F9D68D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58e982.rbs
- Size 19KB
- SHA256 ca3e78c9d2e58c3fdbe62a2c4bb7ec4f17364b1879fb7c8102fabc7c17a2fec9
- MD5 748fff33d8397652578fa2d4c1cad394
- SHA1 98ce781a27c4eace451c0298af1975e00ee03631
- SHA512 63e265f39bbd5e9171f37b014faa71eca6623aa8e1d8f97b0711c70a0b9be42b794c6eff187d4f3d94f3806523234c699d6793fc7f32ffebdfae0dc7c708e6a3
- SSDEEP 384:ovOGnJXMjZ7Up+BFqiO6dygJ00uJ00Goa2D8Lfv/8c3zMZxq+nNwzQ6R:ovOGnJXMjZ7Up+BFIi0F0R
- TLSH T17992BB026640C5E3D8A62B70DD4B67243BB5D7CAA355A38B41DCC1708FA77CA7F8D24A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58e989.rbs
- Size 21KB
- SHA256 c763a3e46e3825ac16792de38185618f4e9859e4e1e9e109c626984c4bf3ae9a
- MD5 afa84010851b8cba00776e6c858ced77
- SHA1 cd79d7c338315659bfdf56ed7347df38b29c3b8f
- SHA512 8b968d0d98e02badcc24a5480d9b91be34df212fac145e93f595ba8d4ca66bbb336aca6d1fc064d323cb16f90ddefc1bf1fd50e9db06e3a6762f205fc29ab466
- SSDEEP 384:oGRfGR1nAKxNAUhUC7xJjrMNYPVIbS/6w43SmpS74B7kP:oGOJAKhCsH
- TLSH T1DBA20E03768099E3D86227B1DD671BA53F73D7D99350434B10ACD1388F633C72E9AA9A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e58e998.rbs
- Size 21KB
- SHA256 edb00daa13d13032653e9b3566b283254047173d4ca71bdf938a8555972f1a80
- MD5 4bf092f431d41ad7b2638d2f24fef295
- SHA1 5158aa01e39ec3b4591889444c761b34cff93561
- SHA512 c5e04dc6ed9acc5c51d4af9432675f20722a22e5f2ffec980d200f8820ae87902b244adfc87f14ab56c804ea38080c3cea790fd32c80d9cc6f9af8e70b47ceac
- SSDEEP 384:FrNvDIAZxEth/phSYjK4WbJGwaZsalckU72eC67JkE5KoJvUJvsrr6c+0dWg:FdDIAZxEth/phSYujbJBTbiUrr6/0dP
- TLSH T13DA20E42BA40D2D3D8A62B70CD97572437B5D3DAA755474B00CC90348F937DA2F9AACB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5e50ff.rbs
- Size 766KB
- SHA256 d38f62b79dc8e18ed0263c2ad264bbe1406932dc68da7141d43387861d3594a5
- MD5 ef491104c0375e3486fc11d86f8c6c3b
- SHA1 2b9916cb3070eaf5343511711468ae80397d8f2f
- SHA512 1d6124054a75675e5188506d909919927c012ef21025acb579de509d6d8eefb6e664888b842f780d792ae103b6c4de70b8b8067f97389ed413e1b95f55cf5bfd
- SSDEEP 12288:A2LhH04mc0nu05ZNiLocE2I2w8TMJiMLXWm3Wf:A2NH04mc0u04LOJ2wtJ7Af
- TLSH T178F48C2279C1C0B5F17326B16BA887588ABAFCB14F76444B23C406AF5A205D2DF35B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5e5103.rbs
- Size 7KB
- SHA256 42119844a48de0ff74a57b0a916e2136441b575db1d726494c73cbc5fa9bb75d
- MD5 5801dc437a3e2b87ff293684b8ec2b98
- SHA1 b079976e9a726fd097f85185c558dd89af15d96b
- SHA512 68848a9f7f73cde5b0c82ac2fcee4d0d133670fa8efbf637652eef2ea4efc9cdbdbe181a9f83b5aac9e41ac4abdfe1eb4a14d2264a565b4ad87b393cc5a4c9b4
- SSDEEP 96:t3WD+5t48RwT/6xowj8Rwx/6CjD3DZD3tctqowXtHIL4zrjDHwuCw9FwQWu5Aaf3:tmsRK68Ru6eto4nTC4FpdDP
- TLSH T146F1534AA60381D3FD5E4F31DB231B3537E7D3EA835C429F00CDA6615E853897AA42E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e5e5108.rbs
- Size 8KB
- SHA256 602da44f40c7f7529a6204fd5e0e67f9135ac02a1f948664a4f6cafe57674f24
- MD5 c3edfc4a91cb9c8caeea84e4b86ffb6c
- SHA1 b0c56811ff8a686673573b99d2ae06651c20d7cc
- SHA512 e4bb79f69899dbfde0ee8e897f5cf48dc594fd8ce16f01a3981ace1a222f8fd8ea65d8e59002641f36b6a0a0807e7bef17719ccb9f59f421c9f830a2d71fe8bd
- SSDEEP 96:t3FgIEIJt9B/eKiGOUGJDkvP+CCsThqo+UGJDkvP+CC6jeD3tbThqowHUm5OwmWb:tVvjneohtnuIVtnuxFKUzFkpRN
- TLSH T1B7024049BA0281D3F85F0B30D7171B2537B6D3EA8358634F04CD92645F8238A3FA95EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
- Size 193B
- SHA256 ee55ddf4cda30cd0f0fdb4fc2d0bf9ecca5dae113d1eddd9b935de8cc7ff432f
- MD5 05a8bfa71a5f65da68bc09688a9b30c7
- SHA1 1620484f5210e0e719d0363d1672501404d57bbe
- SHA512 adf9dcc60912800a0a6d5884cdcdabd82e7fda43ceb49258264cf5d02fe402d36720319fe5b386f5719eb5ba7305fdb8568d126d0264402d84fffae247a49a04
- TLSH T110C0127CCD05D295E14369461B60BC18AA2E79E418DFC45D52C9DA8B5E884618C09971
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url
- Size 188B
- SHA256 c9648663e9c3551188e3cefba529f544816582115597f6f74515fcf3bf496210
- MD5 f1c6f6defb2ddcc6b5fce1229ac121a6
- SHA1 f66e20c488665623db58f573060138e01ce516da
- SHA512 d9aba2c87de61975f7977d46519de2efe472b9741b7d0756ad8035500252af9ecd304515c36cefabaea4ec8aa4e8a65e98ce5348f27784ee8ec6be2e7eadca34
- TLSH T186C0222CC80982D0E24344862330FC28A80E78E009EFC44D128ACE8F0C848918808961
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url
- Size 184B
- SHA256 526e539f958037552de3f2dcf00554e55ce7609e2ba5656e5bbc75ba8c2ddc93
- MD5 213f4b575b06265d884209c1a909fed4
- SHA1 fb97011b60b42b64d709d8ae841561dff044430c
- SHA512 727308dfd4912d071fecb965b0613b7a13e40238dc5849984a16dd7364e8732b20697143d85ea5468aa3b3ce20bd600b336507246ad5212f93547d9351eaccc0
- TLSH T1F5C0126DC94982D5E24354962760FC28A81E78E059EED45D528ACE8F1D844918858961
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_491\au.msi
- Size 853KB
- SHA256 923efbe2cfb8bce0ab4614c589754d5c8c55683c0ea9bb207db5c5f7dcd4f058
- MD5 a62c4182ebad1797409af805ad6ec7a5
- SHA1 f734a144d3a31a844b00b3d954b8231bcd1163f5
- SHA512 e5e3ad2f274d8032f85a8b25100efeb6eeed306763aa89bb45a04d23cff6cb3404f784ee717e8551a2ee213530e9154a4f659d9a9d20cfaecb7b0d48d1c5c988
- SSDEEP 12288:5oOhF3Ynocz3u79veiqvXB1q2soQgBZvuDHyaJ+/qxv35PPZpu0cE4pRwxH6w1Wc:NhFo73uRmAOZGDHxJiAJnTuru61c
- TLSH T10F05336228946FD5F6A47438EC48C2F0429BCD601456AD3266A3FFFB79BE2E4114E4F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9367e8ca-e4f3-4b85-a3ea-f91038bd18e6.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 51a9cefd95eb6c21cc7644832a944a682b945c2904ebc9ca0b4f516e48bbb410
- MD5 98ce8321deca13918e8881f9883f5398
- SHA1 7d1cd2f951731c2223877bbabe62343bf64033b0
- SHA512 0474d179594d57a326b705b405ad168e34bdc4a1410fe6e61ad4f5499b14782719c57f600e5449c09fa5c4e58a7c27bd222767eeb249f9462920ef83a3b553b3
- TLSH T162E02BBBDA36AC2759FA572CA045474AD64013573B50994F363C8209CFB9B3B0185C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 fab846477c122769b879ee71c484881e7aae9098457c285e84ec903253958393
- MD5 ab9444270e501577cc962fa1d37cbea7
- SHA1 d2df27d3f57c9853e56c4e59fe097b817f468b72
- SHA512 8fb0447190b2ac2a5d8435c1a256b119c85ca040a68121f0d77e93015ae71b884b3c0492f6a39ea1d6ee5ea853aad1c6b22a783286b0ad37b0dd244285690c28
- TLSH T1023189241382B765CFA02D37169D99B313AE46218D0A7B4F51C4F421B41F2A260C3BE6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 936B
- SHA256 772125dcc7fcbf534208bea59995b1d4c60e82f1c5fc0e8b799d4b1f9e5f859d
- MD5 e9562eef84fefc04043a00c8575fd23a
- SHA1 0c50c39bfdc1604e4c22bfdf6a225caad717e6f6
- SHA512 11f543b097e334f0e092134b5e27bf5e286365f190b2ce949fe77e0851c26d9b3cff03a0c0eda2625eccc790dc11916df8874b943ced37373baa3849e404757c
- TLSH T1BF112F344482B3A0CFB06EB717AE8DA0271E08721E19B70F82C1B060E42F2A740C346A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 8eeb2761d9721628672225a8cabafc313d3a164af27745f9347ef601beb2c632
- MD5 0f9045d54834486ff3f4a928628b7841
- SHA1 e9ea853f60641e6c383cd016cf76c6c6fddbab08
- SHA512 60856f41db07c11fb57667557cb7c7167a9561e14ea8d7d4f10a06ca1d906fd0143b77e37e762228f8505392d644e21401b22aa1ef0c78d844af2db489d17918
- SSDEEP 192:DD0oMOTmOaIXYVWQNalHwnNPgaPefPIN/G4vHdHp:DD0oMOTmOaIXYVWQNalHwnNoa2fQN/G4
- TLSH T194E16CB7C3E8852D891156F8AB116F1FCE290A24432C3C6688D4EF1B93E2971D21574E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 fa63c7532166542e1984c2b01bbd70cd1ee6f50bb805b0f3d2b58e49102905fa
- MD5 bda1e2bafd5494fd05dbef2c4b2c98d6
- SHA1 a369fbc8d0edc127f041c8d47b692e9c1db11c2c
- SHA512 d37d291fd99d25052a4d81e2626fd38c87f3d6b64202d1b79e07ef0f51d37b78f808711659644d106f277a20939f2d18595301df06cd08009d1f7f8c59844117
- SSDEEP 192:DD0oMOTmG6DT37JzJUmaIXYVBU/G4vHe4tje4rL1IkNPgaPrfPZCvpO4InhmIcN4:DD0oMOTmG6DT37JzJtaIXYVBU/G4vHeO
- TLSH T1D8326BF7C3E8CA2DC91156F4AB256F1FCE190928432C3C6A85D4AE1B93F2871E25574E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 10KB
- SHA256 60fc3280d45732f7a0387540dba9dde10ae76ace7e0113e876f97e8e01565dde
- MD5 4a5949bb9f82e422bfc6f77f5e8f3e77
- SHA1 7367577b310cfa296f9f70cbe895094ca6a15f12
- SHA512 4f23f480e74f99b924fa63cf3789769b99dbe8bfa5420086adc77e4702134185c8a3560885cc2df0565bb35626a023b1b92666c6b71e849c2a1245156ef704b2
- SSDEEP 192:D00oMOTmG6DT37JzJUmaIXEVBU/G4vHe4tje4rL1IkNPgaPrfPZCvpO4InhmIcNn:D00oMOTmG6DT37JzJtaIXEVBU/G4vHe9
- TLSH T1AD326BF7C3E8CA2DC91156F8AB256F1FCE190928432C3C6685D4AE1B93F2871E25574E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 fa85a7c4f7efcf6d6697bbb526dd59ceec7cd9d9d693d9f666dbbf02d3e1eb52
- MD5 6567062e65e38691a7dceac4d92b91c7
- SHA1 5eae01ea479fdb0be366985019175f6bcf443e8c
- SHA512 f3fcda71576833d29435b642e7e7c88610418504c3bd33c14027c1dd416d69f77ae55a13675d02ac1723e2795373d26558818ded080ef55a2b6b61e42fe62028
- SSDEEP 192:7RXcBzFx90v78pAPRp2Z8wf9DHsb+WNk/wf4jI23kFR2+7kwIVyIsnAUgraJ:7RXmzFvw4UXk5wp720FR2+7Me
- TLSH T13952B62EB910693B9CDBD219F9657B57D3F6102271D51E84EAFC8A1C18EBACC312740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 de8ca4767239f858a04ec86c83bb8f97a8bd9dfc841ad48dc9712cb1e5cd9079
- MD5 9d43a9062d6034e880699bb2c5fd8552
- SHA1 22cd839dfd276e529423434e4e0e907d432b9cb5
- SHA512 ff9f4f1e3d86d696e06f0640ce3b43ae04179431f27de570c787af2d0386dd39f47472132c7f61ea6dd3fafb192dd0ba8ffdf863ed98de284fa84e3e36f46838
- SSDEEP 192:7RXcBz0x90v78pAPRp2Z8wf9DHsb+WNk/wf4jI2LkFR2+7kw/VyIsnAUgtaJ:7RXmz0vw4UXk5wp72YFR2+758
- TLSH T1E942A52EB920693B9CDBD21AFD657757D3F6102271951E84EAFC891C18DBACC312740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 20e79397c50dbdd6d23598004902d172dd7bebf0631a07dec1073b0dfebe3d12
- MD5 c83c40a9d6a3796f228fff2b4bbe0767
- SHA1 d2954b070cf1660df6ff9df2eda388566811b0c4
- SHA512 97555d675f0c8b79f5493c387cc2c0bf28a322763d6a5a04fabdd53395c92bbe6d1372fea45fe615b217c807cab62ad4bf216d600e2795ed68c69a3e621fc230
- SSDEEP 192:7RXcBzgx90v78pAPRp2Z8wf9DHsb+WNk/wf4jI2LkFR2+7kw/VyIsnAUgtaJ:7RXmzgvw4UXk5wp72YFR2+758
- TLSH T1FA42A52EA920693B9CDBD21AFD657757D3F6102271D51E84EAFC891C18EBACC312740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 85e7da0cebaabdc5c9ff12b168ca3b29fbb622b1f232da553255b6bc3ee0011e
- MD5 bba7deb8e6677ca22a2d3467565d6d09
- SHA1 fdcf55c9856a7ad3f0d5a046cc130d5687b44815
- SHA512 b9c39a91f286ff11648cdfe72ba500655c5f1b681fc3673bd701825af966c7e610218c4e717a431df634e6a48af4cbf494fff4b208084b4feecb57fb87ae6174
- SSDEEP 192:7ROcBzFx90v78pAPRp2Z8wf9DHsb+WNk/wf4jI23kFR2+7kwIVyIsnAUgraJ:7ROmzFvw4UXk5wp720FR2+7Me
- TLSH T14D52B62EB910693B9CDBD219F9657757D3F6102271D51E84EAFC8A1C18EBACC312740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 4d51094f84ed2be03c16ecb03240f951f44d31fb09754c13541a6c431abdc960
- MD5 9bbf5c9410fea9d5363b7829b11a5bb4
- SHA1 c78510826d1fb0b43549d9505509ddc0522e02fb
- SHA512 8d036bc83a91865c44100f17a2055197139b00fb61ec4abb37382004799293becb86d0748c49018114b5f8db9bace36c94b7c1a334158059f3ffebce86d9ec76
- SSDEEP 192:7ROcBzSx90v78ppPRp5Z8wf9DHsb+WNk/wf4jI2BkFR2+7kwiVyIsnAUgraJ:7ROmzSvw4fXB5wp722FR2+7Ce
- TLSH T1E652C62FB910193B9CD7D619F9657B57D3F6102272951E84EAFC8A1C18EBACC312740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 766da1761dbb53e4180d5dc5d53e8e46782117c89ba8bca643a2c99ef4e41c63
- MD5 dffa7e59a20a96a5be0421bea6719a44
- SHA1 f8464e0485c7663678a07946336d9442f36d490a
- SHA512 ff59717935dec83bee7673542ecc65d08066682e34f378a5a131a67aa9e30de596b01b2fa72cb91bf4033cf45cb0f2f7dd02462a04caecbc5009e41f33ee4f7b
- SSDEEP 192:7RXcBzSx31v78ppPRp5ZkMEpf9DHsb+WNYxbwf4HTWtkFR2+7kwiVyIsnAUgraJ:7RXmzShF4fXu5wXUWSFR2+7Ce
- TLSH T17552C72FA910197BACE7D219F9557B17D3FA102171D51E84EAFC8A1C18DBACC321750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 61b58ee926b1ad8c24adcc80fdca757118108a6b793b3e359ff43615836af225
- MD5 39c22418524edbb574a81f8c844c60ce
- SHA1 ef36de267c28ab71048918bf79a80b91e142cf96
- SHA512 0b73f9d789da4f2b2dd9aa3bedc65ce8e952bb1029c751501c1acac0e9223cd5ffc2f6c0334869f0812036c924ebb69c75d09bb8803e4a63d7a5c870d0ef4209
- SSDEEP 192:7RXcBzfx3Iv78ppPRp5ZkMEpf9DHsb+WNYxbwf4HTpMc2SkFR2+7kwiVyIsnAUge:7RXmzfhU4fXu5wXUF2bFR2+7Ce
- TLSH T1AB52C72BB910197BACE7D219F9557B17E3F6102271D51E84EAFC8A1C18DBACC321750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 118c08587c021654cc4bf19bd05739d1b521d7a0c594d04f7dfbb67ec9c2935d
- MD5 124bf344f1cd918740f639bcf990b469
- SHA1 e2db7de79c33f079f222b79615d8b9be116b9bce
- SHA512 d0c2873e3766f1f93a942707c9fc90ecba9e33d6e832e84310aa7a458b0672076ad52ff854f0017e4fbc5341bb795a8b55c49d326ce7c70bd51a67563bbea08c
- SSDEEP 192:7RXcBzf13Iv78ppPRp5ZkMEpf9DHsb+WNYxbwf4HTpMc2SkFR2+7kwiVyIsnAUge:7RXmzfFU4fXu5wXUF2bFR2+7Ce
- TLSH T10E52C72BB910197BACE7D219F9557B17D3F6102171D51E84EAFC8A1C18DBACC321750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 c93c67d6717b50479c43f439e59d6abaaaeaf6e2c36c03defc508a35e2697cd1
- MD5 26323b56adb0be98ff561b1282343ce3
- SHA1 f14ab9793a5128f1d14a1334ad4aed231532d48e
- SHA512 c20a898c6d5f73f387baf0c539b8d77451f3753dd3c78b954208b1e6522bdde56d4ea37c79a15a303446aa3e5433a84569040b0a3ce3b6ed4a32f68da202ac0c
- SSDEEP 192:7RXcBzSx90v78ppPRp5Z8wf9DHsb+WNk/wf4jI2BkFR2+7kwiVyIsnAUgraJ:7RXmzSvw4fXB5wp722FR2+7Ce
- TLSH T13452C62FB910193B9CD7D619F9657B57D3F6102272951E84EAFC8A1C18EBACC321740B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 bbdbd10cd1d53d8e541ec6b6e993cfe013ca909eb5f45912c4c2907e091c23d1
- MD5 faf7712f1a790554087583b8f60f5e69
- SHA1 3cc178acb95063dd181d56af17ccd7c7b7e06f9f
- SHA512 b1742a05b29c069209d55dbe343536d6aa91eec7596c5601407d94de1f2d8faa0c1a8dbf7bbc031afceda6ecd4c2060229d304d22d1cbef17908973ad620cc0a
- SSDEEP 192:7ROcBzf13Iv78ppPRp5ZkMEpf9DHsb+WNYxbwf4HTpMc2SkFR2+7kwiVyIsnAUge:7ROmzfFU4fXu5wXUF2bFR2+7Ce
- TLSH T1DD52C72BB920197BACE7D219F9557B17E3F6102172D51E84EAFC8A1C18DBACC321750B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 f5967b57491887543d9f6e415d5f75db944c7c317efdf394b0d74aab2b925130
- MD5 b7178c124a1e4b466a5276d83b2e0750
- SHA1 7c9f830f862da7ed5b8f2be4abd415783ca04529
- SHA512 ed7e56a4a8c9d288d250f746619f731ab0856264721897e0703c750e6c67a0e1da406a7d29a762d298a8efd2a1ebc2b6a1d9a4ba0cf77750e234ca18a80c5fd4
- TLSH T1F4A002110AC10822D8444775128303D12B608C100343C69760D46054DC623678F02619
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 fef7c36e1b311b3d01e5f8c8113f3d69148adfeefa498116ed959cc006ab8506
- MD5 3a740142ef36f7a8e8a05addbb33de53
- SHA1 f7e01314c293462e56aa9e8fd302302a43a08611
- SHA512 adf1ee6d9b3e76f9d5264959d60eac4b90250becfd1504998936ee00fa06c912ce81a5b30c1654df26a3cc7fc7165f32ee163bea1335c76ab1bef488a5525f5c
- SSDEEP 3072:bGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Cm7Rkm1tYpBeh2BAoO
- TLSH T17EC3123B5D65E9375D79A70EB48E0B1E1EF249A6C930DE4288D86B0437FA7CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 2e325b2276caab0b7a7c052ce2323ba98225ebad1d91382afff0fba338563b16
- MD5 7d5193db6f031db963d84be8f247bf4f
- SHA1 434eb554af7fa2b21fb98cf9b1b1ef9699cc7358
- SHA512 c627fd03228537ca1420e4bd0d8c4be813d571b7427cc8dc3be5bc9f7ca1f8707824beb9e352a7be89691494931610bd2e9ada9f26864004641c9eb231291164
- SSDEEP 6144:+hVzWC9sbQsFar3Z006lqm7Rkm1tYpBeh2BAoN:+KC9sbEH6H9oBGcAoN
- TLSH T11C342337BEA35E7A5DB97758A48A070E0FF18F66D811CA6F85D17A04178F69C060EE30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 cd5de4a914e28633ad510969592d5bea9ef258cf88f2110a225809edfe3cf742
- MD5 d3caec343929cefc50c9d89dbe6c8f8e
- SHA1 22cca8fd7fc2c1ffc90304f23a7ecfb81c69750b
- SHA512 dacdfddcb171794a805355a61982a29a6d98b3a9125e4bbcbe6f9f1040a03faef33c5aa2db879c0061bfce2af91e20fe8e1e179b8926a8b5f84ac6c0e8982ac7
- SSDEEP 6144:xhVzWC9sbQsFar3Z006lqm7Rkm1tYpBeh2BAoN:xKC9sbEH6H9oBGcAoN
- TLSH T114342337BEA35E7A5DB97758A489070E0FF18F66D811CA6F85D17A04178F69C060EE30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 5427b7212e850a127d453976e3d231367879ecafbf84097cf09dafbb7b99fdf0
- MD5 aaacd90e5088968595a468cb9d92bf86
- SHA1 87fbf08f3d320c21e62318988ec7b1cec9f96cb1
- SHA512 46650a238cde6aa769559ab04af61a2a20721b9807be250609c6bf38bb8273b3a338562f2179ff2a6f4c6a073dd9aec52e4be1b8251f969cac1c6e448af4debc
- SSDEEP 6144:N1KVzWC9sbQsFar3Z006lqm7Rkm1tYpBeh2BAoN:3TC9sbEH6H9oBGcAoN
- TLSH T1C634123BADA35E769DB9AB5CA449170E0FF18F6BC811CA5E85D17A04178F5AC060FE30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 cc2826763d078f613d1a9e4cbe89e392977b8657348586012d1bb64aa3f68ed1
- MD5 e0ed2dfae0f515f6cb2b8427d25b7898
- SHA1 1f4e50f6e9ee85057342e361e518d5e4155d003d
- SHA512 b9cfa1f1a4b7ffc9c31b1c391d95da199be982c002852d13838cdb39e540f610b9e88d8c5816f9077a7b4d73871a0685956f3cd93fbb26c0b2c1e9bbde80dd1d
- SSDEEP 6144:11KVzWC9sbQsFar3Z006lqm7Rkm1tYpBeh2BAoN:/TC9sbEH6H9oBGcAoN
- TLSH T1C534123BADA35E769DB9AB5CA449170E0FF18F6BC811C95E85D17A04178F5AC060FE30
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
- MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
- SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
- SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
- TLSH T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
- MD5 7a50c2e276f05b686e8cb6c95b86650f
- SHA1 bc892af04a9d6b1bee8047f67518d676df864301
- SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
- TLSH T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 334B
- SHA256 12129c5b0e4f1feb1fa9bd1d1bc8e21ceb838861fff9512505a688a28f13ea78
- MD5 ea6f8cd8b92fbc9e882c373b78470df7
- SHA1 98b340c62a6d53067c65121a7185401e21fb8dba
- SHA512 ce300ee0a01664f4154b8b3cd844f055aba6fecf63a3ca6a67dd519e33cca7ba9a35f6f4509e03880e1d24842f54d92cccdbc84387827ff340ebacd1ba96c464
- TLSH T1A6E020C544CCC39DD5456487417C534CD280364ED2C4BA5D7704848D704179067D7B60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 d8cd0ff67ff4a993301a7137862538f82cd3afd00d3d44711cd893b0f62e41b0
- MD5 364828a0943001aebed1c6c6a595c412
- SHA1 45dcfcfa3ddf56795a381be523c06776b7b94fed
- SHA512 009dea81c41f743e327d4e75c5bf1101ba37241ac85efe338a852a4f519c2ae5d89873df77e0078365a48ec3ab50b34d7b0840600eef8ca37fa810405a4d8921
- TLSH T12A712A36E50081F5EF16523190E3177479F7D0DCF8072EF212A728F66B28736672A18A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a1f8.TMP
- Size 3KB
- SHA256 c97974cbae723a42b3f28bcdd1c582a84137d4787112b86ab3ae489b28bac316
- MD5 c2bcce41ae07d366507066814f05e12e
- SHA1 48b0dccb39ec35d00f45badc1fdd13336b12178a
- SHA512 b5ff385640724db74c404cff78803566b55f37920fa7fb48f4dfb6f5daa4037e012300646d0bac2aa7f32315f05b054c8022bc235826dfd29fcb0eb194c4a28f
- TLSH T125710936E90081F4EF15523190E3177578F7D0DCF8072EF252A728F56B28736676628A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2f033020467808c3dae575561a9df82f70a2de42ddd0cf7a7551b06f1083980a
- MD5 e7784309affc15474864318d3149acd9
- SHA1 3a8a7688a9711be8d38683c34ad6df474f16cbb0
- SHA512 4e15f650fcc3160cb4e17cc5c13572a8a08ce3287176cc37cd7cc5619b416139a08e32fea9398e278c101f8b856ee7d91e92b136ef9b5d220bf261abef2fb51b
- TLSH T1425190F7C7E485AE8A6116F0EA247E27CE1D0415435C3C9AC9F8BF9B93F2460E541A0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 0f9c5634e95d0298cd68e1103380911d1337a8e3cb0dfa0b77e94c6b7d27a9ab
- MD5 4f82ccda17b7e7bab21952ad32a96ce3
- SHA1 472d518df668866fde50a58a680e0ecefc5fac94
- SHA512 5cc7ab34e41a8103f76eb99a3fc607a2d3fe899ca2060b9f406984d8ed4f6e2da564a2ba302679cb77e3535a43069d20d734c0d3be3db377e9d5c5257f8f38af
- TLSH T1C9518EF7877485AE9A2156F0DA18BE27CE5C0415435C3CA689F8BF5BE3F2460F141B1A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 89d91432c110000f166ff6dba8bd2b4dcb9ec520046b113c47c6a0fe48481587
- MD5 10899d03b9264ed9cd51f0303821d5d6
- SHA1 78efbb213de4c4361ca0ace9c50880218f096c64
- SHA512 865da0f4767f5d75fa1f27e7828b027c4173aa8eff8bfa18dd3664f7bdebacc7065654caae3d777be63a8845c58cb92d801c20cddc5378141946a20e2df32a72
- SSDEEP 192:sxZdJRNyM/jK1Ml8M91/fnsnfmSIdp2bHW6+WNVeC/YCOyr6MIgrJ:sxZdJz11/fnsnfmboHbV/ZJ9
- TLSH T19B42D812BA349977CCCBD20DFA55BF53D6F95473A2940D48A9FC8A0C04E6AED221781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 9a695b859ca2a4ab32a3f177afda60a74cd8acf579aa8ad8f7156c45cdf7bfd3
- MD5 aaf874b70b6819beeae7e188c6ef5b00
- SHA1 ba872e6cdda2ea7621e2a90c46afe21bce7cfde5
- SHA512 4ddb6b00176043b5591dee1601489b1905ae2fe3624b9b5a06c2f385d6242b5b6f7284c39c1a5b50a71a08f989ffa7ec004282caa3b2b43794d30ee1cdaef3fd
- SSDEEP 192:sxZdJRNyM/jK1Ml8UQsj1/fnsCIfPSIdp4bHW6+WNVeC/YC+lhr6MIg5LJ:sxZdJzqk1/fnsCIfPbOHbV/qvJ/
- TLSH T11F52C812BA349977CCCBD20DF951BF53D6F95472A2950E489AFCCA0C04E6AED221381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 a66bd73c39d5986dc5e55fa2fa4ed6b2b156698b7c2f9cb6649bd9610ab9db07
- MD5 1cdf6413f9f040f8942822ea236b96f8
- SHA1 7ca017937aeb25ffe06b08beb2261720ba387575
- SHA512 1730af66c1f3edcb235941c54b730b46e1d4ca2867f051e5f40246abfa5ea50c1cab9237c933beff19029d9b710a60d2872a718fd91217abc6144a8b3abc984b
- SSDEEP 192:sxZdJRNyM/jK1Ml8Mj1/fnsCIfPSIdp2bHW6+WNVeC/YC+lOr6MIg5LJ:sxZdJzb1/fnsCIfPboHbV/6iJ/
- TLSH T1A452C812BA345977CCCBD209FA51BF53D6F95463A2950E489AFCCA0C05E6EED221381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 28KB
- SHA256 b62403d25fe834884484ae483bb1cd8f940dd1ad30059416ade358f487957cb4
- MD5 42f7c1325120399f9732e95b1974ba44
- SHA1 1dd913b3bc4cd5d0728da1e8db7bfed6f103e3b0
- SHA512 cd1f5ce79b2f3fcd6513198baa44915f9f675b9c5af41249ddf9c3f6e6ea3c2ccdcfa0384fc29d2d5c6309f7f4b6828e2c12350d3fc9aec1039cbfcd7174eb6b
- SSDEEP 384:sxZdJmqk1/fnsCIfh66s8qMpRiYnazAW8pZS15posJWeT+pbOHbV/qvg/:sVJpk1/fS54Mnc7WeT+pKHbpcO
- TLSH T160D2F705A924C877CEC35D19B87D7E33D9EC50926285CEDA5AECCA0C019D5FCAB4782B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 9a38a534b1e219d74081f465cab1b9c3dbeb1296a1e0b3c7b94b95ee2b54e0d6
- MD5 9fd8f4c69e5755442b70a2352632d68d
- SHA1 e41d22abf72bb638818cd1135be0f2727ddbcd67
- SHA512 1416043f9e39d6f6bc40d07872c7a3a38f7cbe6f726416b5a07a36347217a84e280dc372e7596584a36d04e9345ab7f7a5b9ccb564d523734d27463deb5377c0
- SSDEEP 768:O38bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVNron:O38bqn+WvSCt6u1jaCZLbWVmn
- TLSH T10CD20B3B280CCB7E4F845E5DEC266F962DD801CB6B988D4447FA894C03C76EA511B5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
- Size 1KB
- SHA256 c6fa8409454c5f254e65afc6e6d07209745f244f2f21e36b6d363e0f803d7b79
- MD5 42d5f706de96db4763b7a876234d166c
- SHA1 0b10248f73b0984588edf7c87da9023d8174fbe5
- SHA512 5b932070e27801f3cc9b884641dad848d0bdb0abd9fd304552015dcc0dcc69c7ae7171520ed4f3da1e172f2486f5899ddb1c3b109a22fbf406dd2b67a93ef19a
- TLSH T18121109A4E91595BEAA54DB21472A4F433B0CECC571193531C3D337B1D217891A5B5CC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5ce3c0.TMP
- Size 1KB
- SHA256 82d936def3a71bd64bdee496234c25d7798d518c3b03ce906312394b0f497faa
- MD5 d5465e86a5e058ee8bb6eee6b2f19505
- SHA1 1c9ce41d23d2641e2fee3ee58bc747c99e48c340
- SHA512 3452dbd8286293dd797119cb3766270e9e57bb3ad68477e7e4535728518f52127d383f13a4ab496dff5e2c5614ba1952d19cd5d0071a49cfb3b374b2e19e0154
- TLSH T1B62123864A92590FEDD445770543B4F43374CD00A322B393997E263E5C3579D6D4B1C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 317f3b3d0807b81dfcb903fe107a9ca709c0a6f2df71f5d4f3063b96ae428ae8
- MD5 ae5e71b2166ac9100cb7865260c4e75f
- SHA1 da78c0437895025fb29fae1170975af531673f86
- SHA512 5a39f2d82a53aa823f445ff1cf4e148c4b09b8e9b8d20b259fafbbf1891b8311514110949bd28f70ccb4e8453caec3fe74afa5042f59ae3f26bd692581b9d3d5
- TLSH T133E0D8FA29E72860BC7BA3F5247048E042597998C986BC9F1469A2D750B33662856C61
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 64936c8fd6e1c6ec443918ebf6ace57f9881f5fb40a2b4f7174d990f5693457f
- MD5 71ffc38314a86fd93f6315b45b727bd9
- SHA1 11ad864b29a87aba6b85836a64ee3f02017a37ab
- SHA512 61434a2aa9705bf401037759e2c410e9ee8863ea2291b1bd94604415418d21a4f6cd76b6f68ef5f490b283fee2aff15e71fad0122916e13abe37a6804e3723f3
- SSDEEP 24:Kdnf+FcaZdNN94JF+wIj59KiKha391EvtSmXMS8NGyXYKf9G3asdAc44o0+rIjig:KM8IHKlucvyVXIxKkISUIHKp+Mzy+0
- TLSH T1C2916116717A63052C3D286CA261852E1F4531E3305DB8AF3FB821E22E67E524EFD9DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\84c0d2c2-f9bf-489d-b7d0-df1d13cee432.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 006b0b95b248c95e86e2dfeb2b17942f0455d9a9cf7e345c05ac10b00a6d3bd3
- MD5 01c2c7706ebe023d5147d22271c48874
- SHA1 8ae5d0ad3c04749010a1263c8b0d7fd14801e72f
- SHA512 39ede076d2e57c322c9f480f17ad2b80bbd3caae4913f1611cd21d01f98b35acbd50ac6690dbdb71c6a55d914ace9488956face4c1eb4ba5536c259b017fa84d
- SSDEEP 384:mHtNn/s3n9SLsNig2qdVFABbEa+mO7+JHyFITGT0IVx9m:mHj+9APo4ganO7oSFi+0gvm
- TLSH T1D5928C3369389D775CA15085F84B3A2B5FB840A7A5CA3F8585DC5F0C04DF6AC134BD1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 cafdf097bbbf9ee4637ac67df897d4393cac98adfa917ac75ac660f43a18ad59
- MD5 93b7bcb06ae8cd075552623d199b76d1
- SHA1 1784c5039e5d73776bdcf9b5091b71de2effc16c
- SHA512 5a4e7f3a1669e3a2ccd75fc636fb4fc9a30388bc32cbaf1ec7b4ef3ac8a4a3b07564f3c9d4ab77c32458145b0dd3e0d17f00d9616ad225bae0b40e0503d60b4e
- SSDEEP 384:matNn/s3n9S3sNi82qdVFABbEa+mO7+JHyFITGT0IVx9m:maj+90vo4ganO7oSFi+0gvm
- TLSH T126928C3369389D765CA29085F84B3A2B5FB840A7A5CA2F8585DC5F0C04DF6AC134BD2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 0f2319dac8d4c695f1f8c4b319c44c3c1e42b440afb3cefda9eb3ca18bc63b83
- MD5 c2f3a153af41cd421c3e215a168e8087
- SHA1 bfa730d86cd947856740f1afae155c4d7dbc439e
- SHA512 a5d2ccdda60cdf4f66388637d30052223d0ea7d985d73b775c56f6f2efb9237a4d28b379faa996e9f8b5ca627f795f387207c0b57d7331fa1486f222f0855bf0
- SSDEEP 192:vON56Db6QmiUywAHBa+jyOmM+HRgJaH1U6:vON56uiHBa+mO7+G21U6
- TLSH T18702D83579385CBB9EB26E49F88B27279F94203BD9962B94D6D81F0C00D764C234B936
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 fa3b45e37d3fbc93348e5036b629acf298a7d6365dc1700eeee7e18673e98742
- MD5 3739bb667d3d9f4fea39c31dfcb322f5
- SHA1 5e9b5f046d0b477ad72a58318bd986bf3956a773
- SHA512 ca1dc90861d85733e4116c3d8f68381faa86385f44c716eecf8f3823a492ecd0772219da2e0a64de172df5d50368db62abd5508251c32fe74599f48e3388746a
- SSDEEP 384:Ub7tNn/s3n9S6sNil2qdVFjBbEa+mO7+JH7RFITGT0IVx9m:Ub7j+9Zio3ganO7o1Fi+0gvm
- TLSH T133928C3369389D775CA29085F84B3A2B5FB850A795CA2F8586DC5F0C04DF6AC134BD2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 613d2f976eb7dafb546b1ee0882099fa4d12ea3eb831d3cd9b6b811ce214f9be
- MD5 a1fc598bdd56bc6ed18998fa5f9b7418
- SHA1 c2d525d23df58ca3e0c65e01ac237009e0d20ab3
- SHA512 b4d0119f9b33bca30ea6d7ca97ce774877476164c2b2a2cf517cb1e2e135fd4744a065909ba4b23a7c46eede398e772f39f29909ef2ba8c00429b927d4e0d9c4
- SSDEEP 384:8HiFx7tNn/s3n9SnWsN68TUNTUlIll2qdVFjXbEa+mO7+JHetFITGT0IVx9m:8CFx7j+9lXwg6oVganO7oAFi+0gvm
- TLSH T1E8C207F258D7897AD9AD4747F73E2D174EBCC0A3B4856A55B3885A0CCC8A1BFC30A815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 dfebeaab759d69789daaed938caef857508655c5875c8a88944825f51b8c14b1
- MD5 506e42cae8fff056e1e7deb50a4be658
- SHA1 be2c1a82ab45dfb121aaf24358263da8b12c6a9d
- SHA512 3520db27435c12690295d69bf32032b58e3fe695eb6b1f9c31b089964ccaab9da79445b9beaac47df935a154c02bc7bd51ce0eaae1793fcad475da5895e0080c
- SSDEEP 192:bONz6DbzQmiUytA5Ba+jyOmM+JEQFahFNz8qzU6:bONz6dF5Ba+mO7+JHoFU6
- TLSH T17D122B3678385C775DE26584F88736279FD95067DA8A7B90D1DC1F0C01DFA9C230B866
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 a4a95bc6027e079b04c7efadd1f3e2c8a8c74946ab554e7acfb07e5824551b2d
- MD5 657f23d8d1f40850f00fd9c52e553915
- SHA1 7e461e0d636dfb129ccbf02358f4f24ceab665ed
- SHA512 724c1baa40e9b3ec0733b00c6b7380ea32c557d198185a7bdde3c892151ccb7a045c493f7dce81efa584a26843d838d7a27d4d3e4f7d1e80e2ad10fa7b5bed6f
- TLSH T153410658A6F91148B3B76E1A9BF6786E487F79373F06D49E10110E4E4663A40CC72737
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Gui.dll
- Size 9.1MB
- SHA256 ab8e16ca1f087753b216490b217e6edf13754e5a303c577fe6475150e3706ef4
- MD5 3e7556d434872f7337cdbd9c6c3bb4b8
- SHA1 b3a3591e9b6605bc4b2bf33eaae18a9cef6ddd1d
- SHA512 3e89a3afdf219ee73de2535e7e453eee6ba29fb860757857318614e2e286cf66ed788744681ff468d7158f0c8f564bc21b2aab79cd2ce72a8ee266d7fca3421d
- SSDEEP 98304:/17B8zKQ16be6OAZl5XWv7StQiYBNXcqQYOPTmex:v6ie6ZZTdtQiYBNMVPTmC
- TLSH T13FA68D57A2A911D8D57BD13CCB9B9517EBB2701503629BDB02A0CA152F33BF12ABF311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Network.dll
- Size 1.7MB
- SHA256 440d4a640216b6ce66d5d7c1229f741619b5eec17b78aec5be2c31aab36b3419
- MD5 e4e52b0c7e90a7711f8596ee429d8a85
- SHA1 8e2b0cb78d6e2bb6271eab4aa8ef582946119521
- SHA512 1c4f4aff0d7369eb04ea4a897394f7e1a0b0ea0a0177b7bdbc6d267e857b75f44e9788012bea7966679967bffd984b476d45785e697be2603b7b4afbd96a61bc
- SSDEEP 12288:Q9onO5TLgx8PlBYyrw3hutJJ5za2rJq9OeBEd4yhexi9TQ75L3EXpX1m1:h83gxGmFRiJJ51rJq9OvdDhOi+75mXI1
- TLSH T1F8856C57A3A441D6D46ED139CB4B8A0BF772700583669BDF02658E152F73BE22B3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6NetworkAuth.dll
- Size 289KB
- SHA256 81d0b91e4a4742cf1247e97ac70cbb95ce5f10c1c8ea20c8d06153d6148372d4
- MD5 3055ae403f7f9bf557f903ed348fa723
- SHA1 0ef7dcf68e1abfaa8c721c453f67a0f821fef8c6
- SHA512 28e9fbf352eaa70a4166be59bc142737da5a52a7adbe2e629a8b472e5f55fcc5a168ab535b643bf993002bca4743cefb38a9f51dc3473d9674ad63674c05c3bf
- SSDEEP 3072:2PntlHGgash+B1RBKQ5NSuxBqcKu215Pdp8CqhwoLW1kJERAXWBJnuo1kIuxmwBA:I/+B5N5Bqcf215PdpToyyiuGux9BEB
- TLSH T166542857A3A20DC2DC2BC179C65B8613E6B3B4004752CBEF46658B4A1F677E2BE3D244
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6OpenGL.dll
- Size 1.9MB
- SHA256 220587b7473d8698d98119250a8f3d11aba0d4545f0a2a245513100a65e5574c
- MD5 97b1482c09c0318e709ba1b1dcd0a849
- SHA1 ae57cfc7a6df4f9cb1d4702b7314ca2c0dd770b1
- SHA512 2336e1c5b83e2e5c80d420fc44bed80cec9a0564057c6a24fc4e9aec621fba699630fe16e6147aa9aef22e9613aa48736069404e80ab73975272b3f026104fe4
- SSDEEP 12288:PyA2ngdKBJuEum86y+TjfI1CkX9RDYXKI297FcVlE/LY9Q2:4aYum9V/feRzDYucGLY9T
- TLSH T1F295FFD5624AB622C976E2BE934F057E60F3AD53C3424BC388155B490AB57EE0B7FC06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Widgets.dll
- Size 6.3MB
- SHA256 b0b0786a526c2b8cee270ba663323b6d039bf97acb68bf66b072fb5737759244
- MD5 b6410aa11ec4d685997e0b8ee11e299c
- SHA1 77a764ce1636c69834bed2f08631bca588e25d48
- SHA512 8e5c1eae1cfa6faee61d6e5dedf281a789cc53c5cff05ce52551f649feda2e97d1dab8163ab31cc60f15b50157a50d5d5c39f2ce790214ec8807dd8d23be4509
- SSDEEP 98304:RLNqD/uTGvqxgiJaj4mxHJpd9tozE2XJHTYm:hNqDaGvqxgiJajFxHJpd9tozE2XJzl
- TLSH T143667B5763EA0185C5AFD13DCB0B8A17E6B2700443229BCB1169CE592F73BE16E7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\Qt6Xml.dll
- Size 159KB
- SHA256 1ab2179c16cc54db8702791cbe323aca0a4681ecbc5a8214a5e580eb2e62a7cd
- MD5 fc36f5ef938f3553889c19e4618a0840
- SHA1 8f9fb2c35731b00f81105b0344dee8d918153f3b
- SHA512 0f76b59fef859d5db077f5b37ac7df3c551c2af0d3c5ec8481663a4b1d57d3abd4dcf5718863e911ab159512f978fd79cc638242ce396456950d7a779e5cc67f
- SSDEEP 1536:O7LLdm+5hICv8Q0wCslIfO80V+NFu4jRcDXIDlvxe2obYTQj9sYpxABNqEd3S9c4:OrfA7QIm/VWRcDXIDa29YjAPqbTl
- TLSH T198F34B8773684286D56AC278CA0B490EFB73709197129BEF81658A352F63FC27E7D350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\archive.dll
- Size 731KB
- SHA256 6ec07b7234d4cee6bae528f2ac619e3f2ac21c5570f0432276c795678eb3456e
- MD5 9801865f09659312a00d59d3d0531b3b
- SHA1 3d5dca77bd61a723dbe6790f48364fbb14d2a817
- SHA512 47800b36307049a86a3d74e62728544965de4421b0d4d6769358ff3105069db88db6d40a0a850b2a48970bbc45b244eb2f3bf0ae18046e1a1b7db028bace6d47
- SSDEEP 12288:GMSFVwT75qJOwJXSD46qTzWftKgQNjVEcNjzxwPuqCcSzicsd:DSFVwT75qEtXm8KgQNjVTNjzxwjncri
- TLSH T1E6F48D82BBF40669E977C1348546AA27F3F1F0551760DBDF06A483653F23EE22A3A351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\cmark.dll
- Size 155KB
- SHA256 068156a998f79b1a815411bafad2af5369a109276cefba6517a72f28d56bbfa7
- MD5 8b74d6e906f91ec2d459fc58aabb7bdb
- SHA1 6ed805ded7c29feb55fb64707d64201b2094952e
- SHA512 48172de9ce9f92c1aee526257afb309bbfaa063109ef42a2c8654abd8d3ff8e9a58a5d0d87907739bb73ea983f53f3a8548b046c1253ebfd93f5bc6b2a8d1fd0
- SSDEEP 3072:H5FnWcwoMEnY4Js2CVskFVtTmjq8yKEsj0oCLIit+Bm:fWcBSGsvVlFVtaOmROEit+I
- TLSH T14AF35B86E5BC0066CD1BE07C4D6EE586E3BAF2173310C2E716404E65B9E7BE27635352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\prismlauncher.exe
- Size 9.2MB
- SHA256 ba72817825e0bfcba7633a607eba38611929446dda6ad47ef38bb432b5b66cd6
- MD5 ec4eeae9225be174e71b33e8fe7f5716
- SHA1 f767d93ccc317515f69a3f907cacb2fb278b4476
- SHA512 46a3119d5527fe6dbdc103a9708783de50f61b913ac9aae6c18920b726bebcb05ecd38ef5712a3ecb68b1242d0d93c3d63ab6e9d9291756977f5910b6d88d415
- SSDEEP 49152:gzegKRVRDGGrrozp1C5UF3Ozhja4IJvW6yj0g9/Qb96wED4ZZgVi3X9fUVNdrdlC:jDj4wBrYpgb3z6cn+HPiNklsndxa
- TLSH T181A6AE5F677802E0D139C278DB4A1593E27578234320D9EB711DEEA69F335E22E3DA48
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\qrencode.dll
- Size 62KB
- SHA256 8b3fbbdad47c3b8ab98422968e28c134beefa2e78b01e1b8c3618981ed417b99
- MD5 446ef55022ff2c5ed026f13ad1c4d4e0
- SHA1 8ca230231b0b851451da46133f5e04e4bc1d0024
- SHA512 4caded094e70b566c21084955200cf8e7d22bf3c1c1aef0fa25863a97a56280f0f4f099bbd48c4726644681d42afc95298e5dac99e427d1f530f76564226e6a7
- SSDEEP 768:cyXjbYUZqkAvg5Lv/xiHrWlvKUYX5VAdPTLSriqWsmeS2duegc2Ip4D1oTxf1mlE:cWnJZv7gLP3GPTLSvnS2d3S9CfIbHnnA
- TLSH T166537DCA7A6C0189E6574634C2D7CA87F57176931B419BCF1790A7960B33BC2AB7A30C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\tomlplusplus-3.dll
- Size 391KB
- SHA256 0267a2177a1824ada67eb32ca0ee72481309977264c57a6a61f73771306eff56
- MD5 4a115e67d8767dbdc3f8fe647df222f1
- SHA1 d5199214bccd5fb58482cec0f86d57b02d63e771
- SHA512 0c3183fca7687838cb7312f201f87627e9afd34d2ef52b1f0dc4c0ee16a5a37b3dc6681a641895c961fc47370a0c51ef2cce1a8f226b75a88ef416c70202be67
- SSDEEP 6144:bv80P99pO6Zds36KshHf2rHDf0oTph0lhSMXlBXBWfXvjd4J8M6:tPHdVQ9Tph0lhSMXl+XAk
- TLSH T10D849E17FB152076C16AC2BCEAEE4641E7B2BC85834167CF17D995A25F13BC06E3BA04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\vc_redist\vc_redist.x64.exe
- Size 24.4MB
- SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
- MD5 486f81facf798678c3244c7cf35a557f
- SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
- SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
- SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
- TLSH T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Programs\PrismLauncher\zlib1.dll
- Size 103KB
- SHA256 445934e9afce00dde9d49de424f08114ecf9bb27c9a9261576d3be60738ef082
- MD5 49a1eeecb25ef4879ba30feb262a2ba5
- SHA1 2c7926d3c31c72a201b2f42b8ebb618d77856241
- SHA512 f2ba2d45fbe1dd75f1c37a6bee2d7faf7640091743ed38ed13b2eb5993ca41d84afb1f5cba8f5e2574d4bea99300bfd8735303d69394f4a11919d43fa4c338bf
- SSDEEP 1536:6vEyaXGzTqbvqRfSOzhppf/ISUaYuOlqjebaIOcIOZFdGULmd3S9KfIbHhnJd:tdXozVhppnURkeboSZFdGULzTh
- TLSH T1C2A3AF896A7412A6D6F38570D4D28B9EE334B15507A04BDF5188A39A1F13BE02F393FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620111921.log
- Size 19KB
- SHA256 3f23f149b5958baf776db28a03177ee2047f386c02858a0871076427c35f40fb
- MD5 99065ee54a9a2f64ab901d5766c08f1d
- SHA1 a18ea5cb2b655d85b463c1f12e314dffa6b47bcb
- SHA512 3f1d2eefef60e55b5cc94c6b20311848dc71e3a11142b8e7b72fee109902e5b9679bee46e07bc16c8b9d5aa604597086b7246936b21499412aa71bb4a22f59fe
- SSDEEP 192:d7Jlbnn/1n1F1C1q1x1f1E1SsFfh1PcTlsajNjNKuGvzOtJ+0dTcvpuQMQw:d7Jl7fsFfh1+WahR79cvpVMQw
- TLSH T11292324225F8FB292CACE1A5F0DDA97D8F2330652DC12C7877A5A2CC3125959D7FA390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620111921_000_vcRuntimeMinimum_x64.log
- Size 2KB
- SHA256 2c0d0a0f537015d6f48a04e74268d87d327c9d06c5db220a8b166b0a424a65a8
- MD5 1933c4213a384219925644f5edb8221b
- SHA1 4039de7d90dbd63afe8f608b2bd3fb61c269a750
- SHA512 e300202594d5ceb5c0f57854ffe0edaaaf0588dc496989a69fb7356fffb3ffa7a93be43b58b164e4dbe437485b2a16aa62fb4c54012a4a783bbdcbe177824c5b
- TLSH T1CC41A2612AF9081AB2F316579EF3C4A21B33FDD2A934DB4C2244831A466BD055CBD76E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260620111921_001_vcRuntimeAdditional_x64.log
- Size 2KB
- SHA256 4e0057b4b3d399dfb073369722a5eb5886c069c4ddcd6a8fca70b36c490c420c
- MD5 38a6d910e50622dcd1d7044313c65868
- SHA1 3bbb39bc09916d81eb8c0cba99a104465cd9bc3a
- SHA512 58a3f6fa0df63f38b1f9b41bc08c3420b0682c3db31f274ed253272cea7af00796a0661fb8e91a4956999e2bd8d932f7428eb315bbb9194b09ebe877d183d278
- TLSH T18F41D7642EE90D15F2B31B579EB3C4615A33FCE36834DF0D2284421D066BD0A5CAC76E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-8435886907800.dll
- Size 33KB
- SHA256 390ed515d10c94bb91e30012d4ef5545f9ebf5fc20c5c5c9c28b8ea16bf4af60
- MD5 e200ab2783cc152b78cbdb9346eddb08
- SHA1 7b612077e66087b91c7dadf47daa702d968f6b02
- SHA512 d2847e47b96fafe44b86734f8e5aab3d08a7ea036b33425bdd926ba3e2fe08d6b01e438add406d77d916ead7a90b31c4f623508964fb5c6332dd2816de04e048
- SSDEEP 384:ygPOV1Nv9yF7REmEsjAsTuCzlDZcuFODU6eC5C0mB2Qk3tK1RaEypwKNsOfJX9SX:J+s1PE8A9O0uGUT0tg1RfneJs2E
- TLSH T12BF27C566B349894DD5B887CD0E11F5BDEB1307223109ECFB2A4C2586F63BD22A393D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna17863592112394013896.dll
- Size 410KB
- SHA256 e873bf5e77fe8f395882b805d462858c8ff837e1dec95dfba9c4c210bfab4a69
- MD5 0d2ee66d01c7462b2301180d767f9574
- SHA1 d4af286882b5cece8a2cd379e1e2c28cd52b1e59
- SHA512 e122c38ddac2c76c163b5a3a4ea6b6937214ce8c1b499cfbea02df7cce464b4ce26267987f103547019cc0a08bb6519529798364d2bc0d64eb43ad5dcb0146ae
- SSDEEP 3072:mkdxRV6A9MUUrx4zoLjRMpCthRDmU8dciZbJYBS1QTq4yMG49f62058ytaooPr:9dw4ACI9DmU8djJYYqTq4HG49f62k+Pr
- TLSH T15494394AFB80DD6BC61A43318CBF235A773DF68423579B172A28A2F41D93F94EE85105
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna18297003097298138186.dll
- Size 267KB
- SHA256 5a7ff949f6d93d86491eb5b26b1cfc60051168a60622650224b89995ac420023
- MD5 2d2475f1f026dd54e9f3e787ae4f81da
- SHA1 27ff882ac271db547aee520b38e3ba9aa91e136c
- SHA512 07ef110d202d51f096a8b474d25c66b93b16af8b2ecdbf3ab23138273a0771c94dda6426fb644d43dd26cf53924f37821dca4c539d889d435185fff2198b3e76
- SSDEEP 6144:cZkI0LRMj+xkFxdHuGL0x65sz7QZBx4Cp+slm/mgye4:cZX095x65sz7iP42
- TLSH T1BC441917A7B648E5E9B7C03D44236A16F6B178294320EBEB47844A531F73BE09B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\jusched.log
- Size 164KB
- SHA256 91b877d0c6b0a36f53d767636c932649af7094361e1dc0e76d4cc82ae24fc833
- MD5 5f581641ca1a7a8182323d52645634c1
- SHA1 784e66044067580cafe71cdfb882f51a28f4090a
- SHA512 3f07d0fc8f5f066bf6ec5fcba6893f18875267a287e59fda59e22d033258264f31e47734682ba71874592509a9c13051c95d731076c8695f0d3558d31a2e64d6
- SSDEEP 3072:xk+dizBLty6lUGDVzv5stFVbsjx22cSMD0At+FP6DOb3:kuG62
- TLSH T180F3314A862D88FA34235FC3C3AD5E658E920A09535E0A5C35DFC6DE7485D03892E9FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\OpenAL.dll
- Size 1.9MB
- SHA256 5d229e267dcdea81a2c20ca2de401df574ae19f2486e2563dafc43decf057615
- MD5 327d0f8efb2cbb7c638933b360c206cb
- SHA1 4c8d30b2f1e761bc35da48b88628f75aaa7b4831
- SHA512 e8d7df1d985615f24f9ed7881bc8d9569b1a31715cd9598a1a271600ed3712233b4f26c123a39f7f885c4499490598f58042b02d1fb6163347c19899c1d3c788
- SSDEEP 24576:e3yU9YH8BBYrXL43xy17mJOaKR8YPDAsdiE10xNLfbUakNM1Z8aIh0lhSMXlSp:EyU9YH8q43x/OaKRHL58xaNy1
- TLSH T12A95AF17B2A441E8D1BAC179CA576D17F772340603B0AACF03E04A662F67BE45A7F316
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\freetype.dll
- Size 2.1MB
- SHA256 49aa563541be1df58acd982f3b9586553078dd3e978ea5385281200eb42b6f9b
- MD5 9fb262550ef57a22e9f672078c348113
- SHA1 9b8fc55c26c6eb7a6097dbb4a366120fdd8669ee
- SHA512 c428fc9232c30ea08c94d62b5a4922d4927f7966a802aa403458f9484fb4effe2862ac5efb4033d1e76fd89842b13140886d2676887c4822fca6331b186682eb
- SSDEEP 49152:uWi2+37Qhbk8TMtaJz6M5Iq0TTL03lu/Z/twx2+dEi3GCBNHy+sr:P3x0
- TLSH T13DA59D46E2A610E8D97BC174C693960BE3B274010714AFEB56E09795BF23BF51AFE310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\glfw.dll
- Size 521KB
- SHA256 b0548e974e03b1bb597f9696b3f9d75df66af3cbea0b8246adcb2c79de0653af
- MD5 2a87d38053c2f9ff493093f6ff285e5e
- SHA1 5456daab94d9d7f577ca664261ce66e56d4d1f32
- SHA512 30e622844d18fa9e87799de51a978371048a0aa526728ccaa58a67ef538077294bd8c2a204fd7e146e8e30e1c2ed85961048db5dcf191959880bf17cff5f597b
- SSDEEP 6144:qXrheMJZDAYSt2fclQhYBddhKsAYnBkOzyxXW+:qXrhrNdSoVYP/iYnWV
- TLSH T194B4A51967B2064EDF2B4433C6CFB9219477B04C3FDBA49E7E9019E57D21FA180A9B24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\jemalloc.dll
- Size 390KB
- SHA256 557cc5f6dc2e7b410111afe83a11f3a8da8963ca8eddf0c542559329cbc0a5c2
- MD5 0b3dbce09db0a089cb9a202bfb409e3d
- SHA1 c333cffa3bd364f12b8918b8755d7155e51b80ee
- SHA512 ce89dc3a101f11b5344c54f862bb3f3f207868ee46ac75a7ff14bc071f659f74fb14d768d15aa17a209c415df81fa6ff7a492a62d46b4adc914df73be4513bae
- SSDEEP 6144:b9xOYD5LY/t+X/6RWqKE5I5lR4xC1IAeuYNaEv1v66fFeGDn:3OC/6RWFE5I4C6vNaQPRn
- TLSH T1DC843A46F3A944B5D5A7D03889774607E7B2BD284726ABCB13A04B552F33FE95A3D300
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl.dll
- Size 509KB
- SHA256 6a1469be51e2fa8be8c70d8aa7bcaa4a1704055c62291490ea453f3ce3128377
- MD5 5fba38b92efa71a21f01d2b0256f72ca
- SHA1 eb335b881e81315e93c8bed725d9bab75eb5986f
- SHA512 b0f35b4bf9636c9a2db5a1c5f9d8f03d777aa1c442e241d288b7f3a5435fe538fcb521638d5b887324cfb2061be2880f75803c3c5995509aea43ba9b5812de3f
- SSDEEP 6144:0mQ2XkbiOWkzsLB5Xn1hEAIvSumvyIAtroFulyhGct8f8XZW:0mQ2XkbiRXnjSvSMIYroF9hG68f8X
- TLSH T17CB4E631DE22C68CDCFB763A60531005EA7678641B1222CB57A79A4BB11B7F093F6F25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl_opengl.dll
- Size 351KB
- SHA256 19882eb95b4c10d23a5e2caf61672cb367e445ae168f7f87bc69b787108b9081
- MD5 915ff1007006cbefb55b7ff8b964f9fb
- SHA1 1e002182f47d9918ea960dd6302d4e8c5c839a2c
- SHA512 c6bd21e2e4821ef8b28f20fd7f930db1ba29e549b23893d017c9095c88b07c9902e994b313ace75c4ef6136ffc2bb97c6a396205b06e0ef251e7fe0adbfb5194
- SSDEEP 3072:4Id9tCjbLj7TrDbzaEP2VL+8F9gPh7Z24oof7dUB4Ome2uG+WQxckixrIYQVSuUV:4Cwt6b7x32XpduLQdj
- TLSH T12274533BAF97C4AADF2B3539D1940975E12CA8B447042AC3210CAA86F5CF6F451F7E25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl_stb.dll
- Size 593KB
- SHA256 4642e771ff4467baec2176632103e0fa6f0fb8817954c59606944a2e746042d0
- MD5 e3142e48a5eaa2bc6319d60833026e24
- SHA1 9fc7ace36ade66213ca556bd849e438ed13b297f
- SHA512 fdcaf30323ccff577faf6be15ff39300462834b79c96d94240c09bd4338b63b20c3e814b20c68311f5e420913325ad915cb9b62bfc027daeb0c6be32c9d51a3a
- SSDEEP 12288:XHbFZ1z7FpEoI2hTzSUX26iYahBeHzJqC51sMDQPOtoxMod:XHbFZt7FpEoI2hTzSUX26iYah4d1sMDC
- TLSH T16BD48D44FAF684E9E42790385167650BF632341903609AFB43909A6F7F67BE01F3BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\lwjgl_Admin\3.4.1-snapshot\x64\lwjgl_tinyfd.dll
- Size 249KB
- SHA256 a68bca84a9f40b8059db58042db3271a6dfea76826162d4103be6916cc6905b7
- MD5 e74e12a8b8658237e1ce5a5c71b8b8c8
- SHA1 40cf932243fe28cfb2fb92876954758b2f7e6855
- SHA512 a3fc7c59a21e935d2ce81cd66ef4e36972543e557c985f4f8265e3cd60e2eb76504929f6a6048683b6af3729f28b6daae9afdbe773dca568242054dcc0f594e2
- SSDEEP 6144:wyNMKj0dKNrsiywhofX8iwyIrRkYNvdt5uApuoG0+4Y:wyNMKYdKNrsiXof8ie9nvv1usY
- TLSH T1D9447C5473E408F9E9A7A23C89A35906E7F37C160770DADF03A0466A6F237E1553EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskE2FB.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskE2FB.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nskE2FB.tmp\UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu76F1.tmp\NScurl.dll
- Size 6.0MB
- SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
- MD5 bf43de0fb8a2c38abcf7b1cf6be7e7ce
- SHA1 5c14855ddbf563da3bc14af40ea5650d627ab81d
- SHA512 145388afde1367253d723ea78501dfd61ebcfb17d440d324dbceb5d9b1c50dbd5a69946209722396f1d0f3699dc967bedab690dd670eedc9910b75a4e7d13830
- SSDEEP 196608:ohFz25oFKhmagHDetua42OOMoMy+Tgt/VqiWWO+ac88vdPkR:oXmSLTgtDqU
- TLSH T1DA563994FECB44F1E91384B0D8DBA37F9B349B118021D6BAFE4C5E56F933701252A25A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu76F1.tmp\System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu76F1.tmp\modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu76F1.tmp\nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsu76F1.tmp\nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\assets\indexes\32.json
- Size 572KB
- SHA256 2117d1852baaa3b8b23e8bb45681219c8ec30f6d3ff68e4d52be2fd349f621b9
- MD5 fd703028afe429708921ccec813f117a
- SHA1 f8a4b0071155bcfad32d83a39d78b6da48b7a6e6
- SHA512 e50cb035dc54585cd15e3a8775982fe3ddbd051d509a39157cca6fcbb80599523a6c15e95d450780b00e8036edf0ea0913f268fd11eaa3603fbf7ab63bb27705
- SSDEEP 12288:+7hg0P7cK/FtXMA4R6BUl2uQX0y8mBqmCsSM/m8XIB7w+nAMMwvtAOxOzNtHe1mh:cjtq6C1lZpBNW
- TLSH T198C4DF96DEDF37A7F809DD65B57F0A039320C21B9304C78DA66DB342A5899DF2012BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\cache\ModrinthModpacks\logos\fabulously-optimized.webp
- Size 8KB
- SHA256 8894b53dc665a30241a22543fc8e1f4fe9e009f16f16cdd09a808d6c656168a2
- MD5 8d3410d4c1ec9dc9c99413e855744eb6
- SHA1 a2dcb2772c2632a2acabc5f64b2f9e9e3c262211
- SHA512 119f42009174467d8213fb7ba772dfeb995319f2be794cf8874662b3cb4126faadf21326ddbac1b26aadc7fc76e1244786f5f597e136fe341df8c9a6abad074a
- SSDEEP 192:8NgGwxkn8ZOaMH7VHDzVdOmeKp1Mh1joYstnNrjb:8q/xk88RHDzVveKp6h1crt9jb
- TLSH T14402AE01CA12302BFD2F1AB528B57961671FABE36AB1C323159A27617C1EAD8056F11E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\instance.cfg
- Size 87B
- SHA256 7125b9faadae092f2c9e364a633b64ebc1fe6c94e5e65659f704206cb656c2bf
- MD5 94e97f06c2c117d1677a756adc6b9115
- SHA1 cbeef5d7e76958e44f235b11b0ea9f086e8a7cdb
- SHA512 bd2f22be4c19eab1b204f6f773a7ceb2002e6e090710c6a0dd48d5cdedd11250d18ac3dc9fdb142187c4e37ca4d0b22f833eaf6f5475a245c0fd80366534cf60
- TLSH T17FB012D35234203601910607900289004B7803401A6C402D20144DC60714E0C0AC3640
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\better-block-entities.pw.toml
- Size 691B
- SHA256 e7f20f1b6a67808e8b01ac7f4a4dfc3a1b4c6c43f66572e221698a74a7e88c7b
- MD5 da108a60d5bbc03cf8368e20accddaeb
- SHA1 214f498ae58b1bca07793e2196832f717e4b8725
- SHA512 909246daecfa23cd8d7f6718a956ebdc14b567332a6493a4d13a24147315ca3e78d632f1715947ac1cf3f18ee4eb40be3d74cad0e2c0defd946f1bb86949697f
- TLSH T107012386EA33C0322537EF73DDAC123E8270533B462B203008F6456410CF92DF69549B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\bettergrassify.pw.toml
- Size 768B
- SHA256 614fe561180b6e551011fa05b16996e74f98073f1e5367e2b1f28db87b6093d4
- MD5 fc2aef50f69ab8fd66059dfea4ccc023
- SHA1 d3e43aacbb4928d5be4644e744c1b33c6fedb83e
- SHA512 24efd20eaa8bd913673387012356dbedc6a65e925d5a13ef169d34603cada41f00cd544d6c9bf8d9d1ccbe993e58b334d27284a31061c75ae15f87e6ecc26d02
- TLSH T11501D0826AB3D4350023BF72D4FD52374B7025779379D47068F454621ACE85EF96454F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\cape-provider.pw.toml
- Size 795B
- SHA256 006afbf8f4c3d4d3ea962dccb39dc131e1298e56f7002d354043cc117394b24c
- MD5 e4859f575f3931afcd195e342bbbd358
- SHA1 ff9dc188768640f7ce255e10323933a0e4d7c7b5
- SHA512 3b4aa2a7a65bbbd6e821a4a50633aa309b79e11eefc35e6f3c9eb7cc806a32702550337e59585e0d30dc8861f19a99a034ba55f861e448ce819d9c4cd656e52d
- TLSH T12E01C9525E3381220236A7B3E0DE037B41365A3362AAAC3058F1A0B112CE95DBA646C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\cloth-config.pw.toml
- Size 621B
- SHA256 da3e5ce3ec0f0950029287188420a24731f4eab4177d6a4a624a4472f223914e
- MD5 4dffa76c9a7bb573e208f319a8fc600f
- SHA1 742dfb31a149fcff0b84e621574778bb5b3e000f
- SHA512 6a0a8b763ebf539874040dbd5a39373602e24a7d5a93e57741a3167ab5e629710df79e3377a59a8f4683de1d291f14700339968fb9a45f4465170662b7cc9cb1
- TLSH T125F002A72B33EA3350B7AB31D4CE066B0A614637427AA030A0E4709505E982EBC18087
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\configmanager.pw.toml
- Size 717B
- SHA256 5e56f1f9e91abce0a91f4472004e7ea2141f22450a5862cd12eb771d13e98a9f
- MD5 34560e64cef80d8affc2e90dc4421f40
- SHA1 5904b4a2d734124c5c00c36c6fa4e392150d5ec1
- SHA512 7ab52124920379628a9d170e9f8069ed569fbc818133553e37790e8eee291b055f41b406e9a51dcf7bc904a2e6f93a5c58b7e32bb467bfc18f64ad0452e9dc06
- TLSH T1A70110035F37C7271027BBB3E4AD02790331123AE1B1A870A8E82165468F41DFB2028A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\continuity.pw.toml
- Size 662B
- SHA256 9856aaf5ef10be90f96187f65241f694f9fa02dc44b129bf8850a4c676d6a577
- MD5 b24f37d00aab41801db5252506fa8e16
- SHA1 ee6f96c8e59f4209c03cf4e289bf7b4f5a9bb967
- SHA512 434cabb25ee18690e0a051310427f1fbffd88fc4234711282fbcf72afec62fea31b1305cadbbfdd4d5da73431a227948b606caf4a0f7cd6de282814099b15321
- TLSH T16B0123064AB3C3320537E761D0ED436903B49A33A6AAA4345CF041A002CFA5DFAB048B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\controlify.pw.toml
- Size 827B
- SHA256 0e5a567d834da25e3ffab76cb226d9823bebdf963eafa6efa18478e155d72b3c
- MD5 685b91e7d7bae32f262704ca066d6d46
- SHA1 33ba234ef39147f163849aa544778077b2c958ef
- SHA512 f98a713e633456f0fa990557bc533757c74cdbaa8ee7e50b9d4fb700147e686f4a56931e825ed5a3a3d4c1c58edb048584d03d1cd8bea76fbeebb098cb79bbe1
- TLSH T1B401CE421D3383324532A6B3E8DE037B07226133A5B96D311CF1677116DE81DF975A9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\crash-assistant.pw.toml
- Size 649B
- SHA256 129cf72fef95f922a66b136181a16a67316b2de057b23675cdca2dc6f496a6b0
- MD5 2a8ad94d30b9d71b8d23193a2869dcc9
- SHA1 3a038b7bd00fe70c370a7b567dde088d9d929023
- SHA512 8984e49fb773bd965a160dce9305b72299f13747d76abb0bba75616ba5299ec56c106c022a74dbc5329b26c41269f000c030afd46a07b42ea46084aeebc056c5
- TLSH T18FF099026B33E62240B6DF32E59E877A0B304D368536A97090E8E0A54ADE92FB1944C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\dynamic-fps.pw.toml
- Size 847B
- SHA256 8af322edbcfc13bd905ca483ce6f021b73aa1cdd8de1896190db4c09c707e0ac
- MD5 29655ae1b074058607b328043691ad12
- SHA1 733885386848aacbcf119a91878d1e3d025fc1e1
- SHA512 e598ec0458552bc3214ba939d2f55d4e9fbe9644432073c2bf9b17019b5c3c3e1439b85b2e08b706b10f9f72f0b1c2c2d19818fe4b6a556cdc4e952fb0a05b5d
- TLSH T1BE0141427E3384311033A7B2D39D833E85B14C33766A647458F0A46907DE84EFB69682
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\entitytexturefeatures.pw.toml
- Size 687B
- SHA256 9f4d8c48f85df2dcd52aad31bc15a745f9011b5c106a9bee813c50dd49f9bc38
- MD5 050789bd202e2d7f42750f74c8ac9259
- SHA1 a8f28a54c273ca4789d66dd9d19d0a7543df9ef1
- SHA512 02b69e1d12bd8d4877b03002bb5e5dea7df90eed585c1835e5ae577271e8356edeb1487d6b73e587ec5aa2e29feae971bbae9e129bdf538eb8e4d65f9ccd8668
- TLSH T1D4019E4AA773C4620827DBF2E9DD56398A714A7B1A5654F091E414A844CF82EA2180C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\fabric-api.pw.toml
- Size 618B
- SHA256 77715ff43f67b2e150a5af9d6b4ffedc4ff05f8b685c142cda30ff3b6388d658
- MD5 c6e1447d4562c84329a775edcee0d6e4
- SHA1 dd268cc32c65383ccdc8fa3e20ab8ba93cf52bb9
- SHA512 db54061620112662572dcb0ab13da29b62d722a7a48118d4aa69f55e075b3b890301c5859f2737703b8573086917c24d691e438a013e22feb3b91a0244a970d8
- TLSH T1D5F0A27B1E3386324237D774E09C533706305D3697B294B055E515A8D9CBA2FBF84083
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\fabric-language-kotlin.pw.toml
- Size 1KB
- SHA256 ee19fd713240c0fa9cf648e367db3e0d3e320a6ef334c12f660aaef89b7d20f3
- MD5 5e6bd0ffd55eb38e3f96484834fbcb2f
- SHA1 738ad00196dacb2089ad56ce63486f01c47b5913
- SHA512 24fe94d6eb2dd9b6bb2209ae010ee8694cdbcb8e6254bf25139e77591e5b623f4a394addc8f02107df48af53fd50c0d5e03974965dae26059f7132050fecfea6
- TLSH T1A321BE7317338C3134ADDA77A06CB22F15A409239C58B56072908955AFCEB4D75F1EF1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\ferrite-core.pw.toml
- Size 639B
- SHA256 9b2304f9023f080df74c3621fda406278bef3c50f5ceec2abb93ce76f689875e
- MD5 edb98f11ae803608181e7fb25d11e2de
- SHA1 81b6a4f7ece06d5ffa78aa88449407e87912c458
- SHA512 871d8cc28322ad977cc31a25e295c18800226b5b1be0c917a89110989224f3af85a369668ba3afc1204903cbaa73fa5cd861783379e55223dc8b4e7c3e976578
- TLSH T1A6F002172E37D53343729FF1D6AC43360B20257FC326687455D0B1DD44CADADAB50186
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\forge-config-api-port.pw.toml
- Size 771B
- SHA256 1ac39c684ced58a04169a7b4282dbde9639e9c48b23ad06105f0c7bcd75f7b3e
- MD5 76bcaedbe1538e248e74f83c607fcd83
- SHA1 09cb7389600c5232370e0e1c475773b973dbfb3f
- SHA512 c20959967cf1b96ca770be2451edcc37cfb5cf4961fc7df3c7e564f260423efe04e5b6895520de113fa08cd22dea2a42d553bd59550619ee1e5e844c27d6ca15
- TLSH T1860190431C73CE760537A3B3D1ED013707234977A72EA83598F5215522DF89EBA24087
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\iris.pw.toml
- Size 692B
- SHA256 479835c2125444fc0ff31dd24ddebfffa8f3a025beb6912988537ae85cab9837
- MD5 0db654380e50cb7880620568801ade16
- SHA1 5b92bb878af54485244087b996cb9f1363abd925
- SHA512 8804a9a9f758703da92a56e89aade8d7c9abb21ae9645535274456cba0dec337febefaa14f47b8308b63e9559c5d25669674ac6afe337ba1962e2a03a43ab350
- TLSH T1F901F485FB77C9334973EB71E0DD433107B095361275643044F4649916CEC2EF515183
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\ixeris.pw.toml
- Size 632B
- SHA256 04e201f44193b1491a62d07feb723ffa97fbe34c897ac96d11e4f2af01a97f0c
- MD5 e6fed535ba40b93c014d54dead705b01
- SHA1 fcc66c454f88e784f05962a6b78e4cb0e3e941b9
- SHA512 9ec8659c6abbc15950e4625b7bb555ed17291c00b5373e8f82c657dec7bc3fff13fc0fabd3233025c4199330a9e8f6fdd1178159783ed741762f6b9dc3527796
- TLSH T199F0021A663391234473FF31F8AC837293204A776FA28CB090E1426049CB82EFA284C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\lambdynamiclights.pw.toml
- Size 895B
- SHA256 f638020ab0cc272c0e22eaf85a7341c44f3f635c84c2f852de37bcd03faaa2f7
- MD5 fdd993d71d757e271c460ced09eb8aad
- SHA1 bd71a20305859d3518abd1afed9a8cc0744a2388
- SHA512 9ed67fa07f717876b1f9aee32c3f2a08f38bc4600ecf9b2651f5c4e9bc7c99b7b58160716572b7b8ccbe8b0b16f33c48d99fe34a94bbcf8d9a5086b6bb879db3
- TLSH T1D211C063043384317176B667D0AE2B3643311E37B5B664611CE042A046CC69EFB1118B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\lithium.pw.toml
- Size 642B
- SHA256 d1e60a9a8f220e90d259c99f1dcf974e444ea878016492809789bd1546b9b049
- MD5 e319de233c8482534eab120b903415ad
- SHA1 68beb0b96ee2f5399fd3bd70537ad7127d0fa8a4
- SHA512 00b5ac38d79e7a4398a5078dbaf8afe4b27173eb8131b8336f787766b97bd53a974a16fc63c10bd0d11ccb27ede9118513db50fc9640d441c37f860b3969137b
- TLSH T1EFF0D3CB5733C632216B6B35D49E627543A04E375736F4A05DF0555805C9F3DF550087
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\main-menu-credits.pw.toml
- Size 667B
- SHA256 36960d15997726377047ac8c0b80f7faec0373ebce1c4492caa5097468fa565d
- MD5 6d923a56e369c2cb23b988dbbe9c3519
- SHA1 cf4cae45b028c666a5c40f612026fdc0295c7b55
- SHA512 eeb3d5241ace5c1d37c3a0cece9d0d5b2049a852891d10797ad7dfa8e418671a26148081623219e384b1195bfd4467407196d3e4a8d3c6f20c9b72c72fd0d0fd
- TLSH T144019E525537C033083BD776E0AC67A6037485678721D422F4F0615ACACE85FE96408E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\modmenu.pw.toml
- Size 757B
- SHA256 214cc76b8a7b44494de02ec390b2ca8eb2d53d50388776af2a10846b013a72c0
- MD5 97c2280c9f38df51202d516148e639c8
- SHA1 e0734ffeba95eb7290d3cc76d0aa7ee0ac078c06
- SHA512 f5a9f1f89e3a36730115fc792fd5b936b9b4e840cf4f9986589829f3c9e727215a6d06087a880eacbfec511c2a61f1acc2cb3dc6a789c6879ca7423ea1bf8606
- TLSH T10D01DC474AB380370037ABF3C1FD82AB46B18632C676A4308CF941A566DC51DFE69B86
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\morechathistory.pw.toml
- Size 642B
- SHA256 f1798a8e4842d29b2556a11b3825661465477c78525c9c2b4473b53661f58365
- MD5 e97b39bf1154f9fa436fa790b2f9aff0
- SHA1 0479db79a4bd5eb1e54133e1937cf443c2cd3059
- SHA512 52d87f08e489cbe1d8b44345549170f569418b86d0228928855baa4a543818de8af552d7868496232db746e778bfadf26c2ee09913668ca93a88d72ea9f53d21
- TLSH T19EF0DD0B3D33CB3220326BB6E999122702216837E226F87065E062AC519D9AEE7309C0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\moreculling.pw.toml
- Size 691B
- SHA256 a6a543899644a66ec414ddac8e10b4c606f9c402fa4747a36a4d4a58c26f5a74
- MD5 8c42a5292b0e500c40b4855a4f7bfe9e
- SHA1 b17834b68f3d7c25ce62cf253860505871658133
- SHA512 c14ef25a0d7f383dd755602051f4c943c342eabac19e8247cf04aff900c0fd7d0a7107118f47fca92cf026be41029557b234647b979bb4abf482dce324fec7e3
- TLSH T1EF01CB425B33C46641266A73E0ED167E03704A324676E4A0A892916599DE82EB924946
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\puzzle.pw.toml
- Size 671B
- SHA256 e1dcee631de35538362c7d493aa981825a74b11cc3e9c775ed5d57082e5bc7b5
- MD5 bc0e65b0e88c52617a39b999ec6f92c3
- SHA1 74c47b4759efa58d74bda8eaedff1034d076522a
- SHA512 d996d11e643d9f173c4569d509e374ebbc31cf6c65a081f726f2f75a7e647b24eb36b2e2688d57e483bfd0902127608af5dc6c86f440dacb72d37d71f0ba4df4
- TLSH T10B01FE066A33C6320123AB71E49C412916742A324B3A54F014E095770DCD41FF9141C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\reeses-sodium-options.pw.toml
- Size 860B
- SHA256 7ee3df215209378688a7afe15304a876035c55b863d5aadc1aa3df8a4fa51627
- MD5 9134be61d93a064728c46b2667d4bb3b
- SHA1 28db3fc7a7e64f990471e71dbdb8041c10efb498
- SHA512 21911bc51d0437459eaecff01192c3c3d0fdd7e9bd483bb059fbd14a2036a81362c22462af6e7c049285418c8d6797cc8bfec0004808e3c83832ed6778c9aa5e
- TLSH T17511AF423E33D1320563AFB2D0DE5236C1346176966E58729CF9617907DE82EFBA1282
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\rrls.pw.toml
- Size 672B
- SHA256 5ba36575a7ddd94c3ba5cccc21e97ab256a2a8e27fdec73714e839850bcef1a7
- MD5 09adebfd011ee57a0e7278d7c422bf0f
- SHA1 4ad7613fb606fbd0970832c45f066d3e155abce2
- SHA512 6bc25dab1497416e6d9c5bcaa4a9337669226b18b7532360b9da1768f13e0b9c5a70a442babb3413f072654a780287310ed6fcabcc17c086649559db2f969aea
- TLSH T19501D3452A33D036416B3B32D0BE532E87705637536EAC7184E0819482CDD5DBB45587
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\skyboxify.pw.toml
- Size 799B
- SHA256 eeb520c5c1f0a1e1de66421b5d85426afc9123a1d1a947f81eefd260869b8c12
- MD5 a08a3e96a51733caab21954820baa40f
- SHA1 fa9eeafa2d5c2b68dce923014c31aa39dc5682bb
- SHA512 3166877b7b1931866dab821e7c80f96a3c202f63303321d4183ba9a2a3cc95c92ea34f66fe72f5910cbb2bb4fc67a819ad3840a12592f0703da9db6eff2114c4
- TLSH T16601BD421A33C0324433A7F2E9AD867B43249533F77AAC7158F4646517EC4ADF939286
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\sodium-extra.pw.toml
- Size 832B
- SHA256 edca120dfd25b1ed99309634ad9b6cd531678d2c6bb1abfcb6752b6352a3be01
- MD5 5aa53758ce5baa8208c8cf7bdb666946
- SHA1 e77281119a10ee7a4e44f83f3a251c4d638c840d
- SHA512 827ee22db9706a552c3cd26d24915185deee862dbb50bf352f0509cd88a8b11d8b575a68a63f76d1383d363ebdf9cdbaaed3e02f35dccd863203906213a2dcac
- TLSH T1E3018E823B73D0354527ABF3E5DD033A81604937A63D5822DCF551A506CE85EBBA81C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\sodium-shadowy-path-blocks.pw.toml
- Size 749B
- SHA256 4b98cc8c883e06ba37a06021eee1abf39083f5ac5b8048f0aa81c25a5cf243bb
- MD5 e31d6c0bae5e036ada7a192a14dc3f4b
- SHA1 23f6e59514c66fcda7d488f5e346dfcf874d75ab
- SHA512 57da4a5be5051db03dd55fa116dd07d5240fb2b92458dc7082ef31df66c7e2dc500144eb5d6475161e8ed7805879ed07d1b1a5867234ea68223de0804c659e21
- TLSH T19B01BD531937C6224032ABB2D6AE427B0230A63BD79D9570C4E6665200DED2DBE58641
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\.tmp\6440bc\minecraft\mods\.index\sodium.pw.toml
- Size 629B
- SHA256 da2392e4cc915da46dc6399a26e73c6b740502b1daec1b9b7fd2f744aa0afea3
- MD5 9a2cd28187eb3abb3322808f6ab2a852
- SHA1 c31b555bd16e3a0715af65d8d6b3b5fc1535977e
- SHA512 20a57d493a2d22e3e2ad88ecdc1c1d9a181cbd4054b1a62b230794bda1ffbabefdc1de016da16f22b34799170a0c296684af20072d9811eeeb3bba6f09b43782
- TLSH T162F07D462F37E6230573EF76E59C033AC971463BD17A9460E0E5459A14CAA5EB7441C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\instance.cfg
- Size 132B
- SHA256 11ecb85c09fd254595774353386ae325b2e1262369a2f3167d1fd9b0d2a97370
- MD5 b5eb2a842cc01a151058723216905623
- SHA1 da4f99ee4ee99794220cf11fb6d89858352e00e5
- SHA512 d25f7f7973a8f11a96e78e5ddd52cc848c82252ec4e85cd5d4cddae5db8ccc14ebb2c8cc279fd4a7d98c7d9ebef04edf9a3f1b0a07d8b7994301ab063549a3fe
- TLSH T1A4C02BC33770103E00A8050B84038C110B390300157C442831384C871754F0A06CB385
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\instance.cfg
- Size 194B
- SHA256 1acc18c7df7aefac294f496b1f1159f187beb0dc3de2e93be1af35195e41ec90
- MD5 b9a4bd73313dccd2e553181638a5100a
- SHA1 35b09977e8ca6bc2d298ba907c38c87ecaf79795
- SHA512 50af4f2b012c8f1868767af198789b80cb0b531a36b833dd2e2e683f247e085bebc1e4ff715c09648ad2c3da9208caca8916ad594a1af402f5f5d464cc73e27f
- TLSH T1D3C022C37B30103D2CB9058A4903E9221B39620015BE412C30280C42A250F0E0BCB28B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\instance.cfg
- Size 475B
- SHA256 2f59ec96cf46389e4fd3e6e1bb2b0ba6d4e16a0a02b0a9e4039223876c0ccf7b
- MD5 d76cdf3c200d39c812c5ae3253f933ad
- SHA1 398a862b645ce97949f62e04c9ea4f6cef7e1aee
- SHA512 58ed087ef8688a345a70d475bdd9faa095dcaa64df7e2cf086089ef8c815a044b272de6a5c90944fbb23038a580008748ec7fb918c4c2c7033c2eddfe9691f9e
- TLSH T19DF0DCC37B3560BC78A94B0F4F43EA23132ABE08645E4078F02C2D0931A1F09A2D618A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\cloth-basic-math-0.6.1-17ea6dce277cc3b8.jar
- Size 10KB
- SHA256 2527eb04394e7a13fa5b8884baa9319f60b07ad6229d759f9451563cd113c059
- MD5 1445462108bd5d14484e817e5aa793f8
- SHA1 2ddd64b22126332794a5754ff9b942e17fb44c39
- SHA512 4a06ad636a80bbe1315e3b756dbc49fa6a911de9a945d5faabc89f925a310300ebdc14c325faee825e7a25cc1e2da2653350d1188859619c7d0912ed6abf1e45
- SSDEEP 192:mPuR7hf/tOar3f9E20UbMtBb2+gr7zDKir24tFKi5Iol1L:SuRFIaxEY6K+grzNr24fKi5Ic
- TLSH T120229FB96927701CD71DD5B824C627B77F71D4CAFAA6107450921B234E5381B1C2DF1E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_electronwill_night-config_core-3.8.4-305d14ab144f848b.jar
- Size 378KB
- SHA256 1af534fd61cbce64e89ee7072536396c2a8340ac3dfc1191cf95356a0228ca35
- MD5 0c4fd411a65d59d2fc276ec6c0865035
- SHA1 67a5887d1c680ab1fdf677ab03fa86f5475e7866
- SHA512 1b8c8dee103c5e0fa9adb2f8170f6bb62228d7223e8e75e9fee4ddc91ae1f83570353dd9279dd1ce1c591790dfa20c66d3b21da1746e42239bcaaeab31cc41c9
- SSDEEP 6144:asEDA8Jf1SNHvSzu7dL7WaZA5LDdfq1T5bK8ZvRadCtmHGa4XQJ5jpQKrgl6/Wrc:ajJfaR7dD2pDdcK4aItZasGTQKQa
- TLSH T14B84CF17BE4CEA7BDD175B33E50598391E2843DCD04D712AA8D46B06C872A86930BEDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_electronwill_night-config_toml-3.8.4-911139640ed50e00.jar
- Size 39KB
- SHA256 546f48b30f87e238dd6f68764d7a98ab9b2f5faf94f3cd876459144e19050f4b
- MD5 12e27cb05c4e1ffa55d10a0d426ed40d
- SHA1 e96bc86c925ff2f2ad9ab8736cc3f034d71a2f03
- SHA512 8391cf6d6237434f58596d61dff3c07a841aa3887b0e62aa5d4100376656878f681f9ce6d9269b29db878b6c82de39822a28475a570d5fea93b02c5c06ee9bd1
- SSDEEP 768:7dyF3Q2E+MKTW6VJNKFdA6IsQhYi6NeYu/HOArIAfpoEZovaZVVvb7+/uWxg6z5c:Ry6l+DxE9Ilh56NeBjVfpoKiaJv2PPi
- TLSH T1EF03D0367E9D896BEC17693A6A4CFC76A921CBAC614D3112B0C0161F0533C5B6702EEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_moulberry_mixinconstraints-1.1.0-97972b36b9db2de4.jar
- Size 28KB
- SHA256 0f8dd72dad5df63e6c334620b37d4aed152dc76d8d4c7d7abf1c7b12c1bbe9e9
- MD5 13e744932e754f100d0c63118f38f32c
- SHA1 b3adec4dcf364c7fb74b6a5f8d3ec4e614f0026e
- SHA512 62b2274259b84326e574d8cbcef90afb248c2210e4f7649d30c93cbfcd2f6e0d9e0f9ec0fe5daf6639af8321829e453e2cbb041d74addb83bb5ebe3f3fe143cb
- SSDEEP 768:Klsy+xykfnYbg3W8DyCl801nbHijMzIEakV0O:7FxykfnY03tWgnbig0EbCO
- TLSH T1EDD25C1A6F9CD03CF963E9B40725603A21BE9B36F555168F23EE0A5F9C70C258A06DCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_twelvemonkeys_common_common-io-3.12.0-86b1ac244fa6455c.jar
- Size 90KB
- SHA256 e5401be7ad9fdc80da321b2399480d0105c27ac82352f95364db93fed6058809
- MD5 dcb5fdea86c51b99677d5862ae173c06
- SHA1 8407fa8b9dda5c2796e6eb7b2c26d979bbace94d
- SHA512 035e596962bc1845e3c7d9c7ce0702820b7d6c920656f09b22120254f525ffc9e7438365504f32d54f5ac84d1077465e2c1cb013e264e46311fa3227c355b5a9
- SSDEEP 1536:8Gb5xwwkHVQLgwKSNhRIoXa7kpHtklRZjsnNoTni8WpKP9kFYqzQmP:R9xwwO+JKSikOaARCiLi8W0P9w1Qk
- TLSH T1C393BF63FEC9851FFC07AE71F0F6E017704818A5D8E59D17289826A1C823D858F67ADE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_twelvemonkeys_common_common-lang-3.12.0-6be701ca605fcfc7.jar
- Size 119KB
- SHA256 eadaa83fb9906d3e9d01ba43f06ed0875d7f404afbdaa70f0b98ce7fdeda7ab4
- MD5 23103c196d28e5dad2e4f5d8b9a16aab
- SHA1 a39056f0bb31b8125c7cc743dd140a21afdbed9e
- SHA512 fa6126775117925ab781fb7203926554a13c31fd48598db2b2093aba366e56ed450aca7fdcdd537f3ca03e5f20ae77e3307ea2b7840c8be534bb333c880798a3
- SSDEEP 1536:RtlN2zDp74GvyMw1AcW0nDOhDy4Q7qhx31QHHso7DN+uY63etO/5oyTYav8hVZwW:7l0plTKAV08Q7qn1QH7ouN3ZnTv8hDeK
- TLSH T12FC3AE16F986897BEE077930C0B2E103341854A9DCB6991715AC26A6C6E7CC7CF3768F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_twelvemonkeys_common_common-mage-3.12.0-deb3b1501a6070e5.jar
- Size 78KB
- SHA256 eb5095e196b84a3c2d17c2a11ec0bb2aa9a7a2e48c68eebabe54438b65a77332
- MD5 0eb17e5f8641ad77402962a05c0b269b
- SHA1 90cad0a90d17581fa064ae05f1060851ffa109ae
- SHA512 1b4929ae23ad0c0478dfe2a1252247e9b89257bfad3f13acff02a1cf97f2b30b6e3fdc71160d791929a422fec16d8e98be4b2c0a9fefdb700cecdc3105be76dd
- SSDEEP 1536:70Pjw/MHZBUZSKlyBdAYCvTjKXYNHqK6M6u2sJ/BjFIzwfWLg/y9stf6n:or9ZU5jKXYNHqg6udbFIbey9sd6n
- TLSH T1CF73CF13F99A809FEC03BA71F5F2D267FA539828C4E1DA871558DAE4C053E94C633A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_twelvemonkeys_imageio_imageiadata-3.12.0-d4e6b5ecedfe42c.jar
- Size 81KB
- SHA256 fd5eac600bde93a1469caedfa00d3efc7b46a91385a0850fccc34e0f41ed47fd
- MD5 9361a448afd12689669a8b1dad9ee595
- SHA1 8dab15a3950c7a38283162e657d1dbc48d76a0f0
- SHA512 c0befb6d6ba7bc3a2244da73586eaf88abf3019be11ed0cfb0e04f1393cdbafe2b5a8164c54a184fdf58be4b85d3ad14091d8a9c555a35a3313d58bdd2951d89
- SSDEEP 1536:pfGIaEA6dr8uqfS68ZAirhxd0w0OoCpLFzgYDR0r+Q:pfJHdrBqfSMSOw0EppzrDbQ
- TLSH T1C5838D49B95594E7E80736F0E4F7D61274453CECE885ABA70A085AB68CB3C807B335CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_twelvemonkeys_imageio_imageicore-3.12.0-3b260d8299c9b513.jar
- Size 117KB
- SHA256 264c6b9476d950f93ddf83527685282ab03274013a790d2af3907dcee11fb26b
- MD5 0c91ce9ec443304a09a84eefe6de2607
- SHA1 975f8ac59c197bc53027d541c9b4b39acc0f5a98
- SHA512 17abbf69c398888ae8a6b6157795f8c8767ab36909ea09262eba2e2d76ae231276dc388f3179a24d90c46892e09ceded5149ad0682660598ad85c7fa167e1316
- SSDEEP 3072:4rj05NQPmlT6iK1zLJeZkiG+O7CrJ0LHXS:4E5NdleigLJeqsOerJ0L3S
- TLSH T1E8C39D0AFC99805BF80376B0F8F7D153F1446828D4F6CB5B2568A666C467D828B3368E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\com_twelvemonkeys_imageio_imageiwebp-3.12.0-16e1ec7310cf986c.jar
- Size 78KB
- SHA256 eefc795a63c12aa2b64df751eb993f2fc1aa31a5eff6e24ccea075cc67bf8886
- MD5 dde00b1cf602b1ffc081adc4f6aacfe8
- SHA1 13bf579b6052a8404c43c139824b514590f33656
- SHA512 76c80b4ec1a0912a42db46835525312660831f10b2af82dc8186c17dc01530cc6b519ef2191ff2e6d5df490b9ebf3aa910658fa96fb1b0ad146e7fdc46e33b6b
- SSDEEP 1536:/hd3g6go37mJ4vTmdQrcqegmoAhC2qSYlm6j0RzEN/cRugpnS:DJ3p7mmwLhCjlARzEN/wnZS
- TLSH T11973B03FB88D5C6BE8233575EDE69152A1C828ADD5C3C76B3024A56E8887C444E732DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\conditional-mixin-0.6.3-371dd4ded000e1fe.jar
- Size 27KB
- SHA256 a47f6d77707f95243345b6e10086f83b4bcc329f66686904ea3c8ad1c3393f94
- MD5 ce64bf56223957101f2f7e3080b352dc
- SHA1 f6a471d57731cebb2d7328ea69bdae97ee3f24cb
- SHA512 74ec8a5b46e924c2122d72c5d25afef0970b39b89037c813641118201201d044225c1029ad8ba4b178f4f67c47f7ded515ce2ce93bb8ec37781d9bcd20eea5dd
- SSDEEP 384:cCxvUI97GtSIki7Zm1dH0YW+tCDulr1lJk9HOFWuek+ckJxK6cuh+d/anN8KgNZK:cZIZiQdUOtJJktLkSKAaanOKgkbazwp
- TLSH T120C2193B7E9E817EC12B9331049C9463D8344288475E956F089393EE16A395B2F5FECE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\dev_isxander_libsdl4j-3.2.18.rele-3.2.18-79-8855283fcbeb23eb.jar
- Size 86KB
- SHA256 31dcf3d2a625b27548ffead0abe6f08af02a22835e1623c425ec8be2bfe97996
- MD5 ba05a350fa4f01f0145335e1345a437c
- SHA1 16c99bd6aef3a3c057a6890bbde30040cdb9355a
- SHA512 d2b3972394a11de0eb49ca0cf78a79bb469e0e537142204468d0e51927ee46a80eac3b0f76c30ec99259b062d89dec89508ab766bc9dca694da16dab6f077058
- SSDEEP 1536:KdE+RX/J8grRtg6mW0Y/RR7TiZq7Thp37P+kAifRA:9+g2PABMRR7OQjLWk4
- TLSH T11E833B292EED64A3FF07C074C0027E02287A0175BF77E0522AD74A974A7D5AA0F5DFA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\dev_isxander_steamdeck4j-1.1.7-a49901e500f24a2f.jar
- Size 43KB
- SHA256 2287929f5324a01b457716cbcee8c7182a4a73c6d182bc8d9cf5b7dfae67d9a2
- MD5 573cee6687f09241a39062be43f8ab34
- SHA1 f1c3530cb0dbf2cb1f38da222ff99ed6d21a6a0c
- SHA512 3a63c95974300bfcc4d97afcbbd6b9f30b6b3d15ad051b0c075b128a1c933da0cf877977921a2eb6b524598a255bc465b011324c034971bd24bca98087137c02
- SSDEEP 768:4zVn+av2h3zQYXfTb0TjLDctVdvPN07RiEZ51zwwqYxJzB6XNhXAvsH8nF:4z5NexzQYXrI81N07RiEZD6XNhXAUHq
- TLSH T10013DF1C2D4CC160F17B8530D2577E075E296699EB23B627766B00EB8C39D190F8DACB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\dynamic_fps_common-3.11.9-7d7a5afcbba3e9ee.jar
- Size 168KB
- SHA256 47ca415961ccf0e564a0191f9969e859985409a5df9af4dc56b9160563c93e05
- MD5 06a17b44d6a67648e203b98a310a4da9
- SHA1 fd58db4fe19f82a8abe9247ec2f42c7f260b8e73
- SHA512 326ba288390cf6c4a311dea3342130444cde43b31fedb4f0ee768efa40951d9e26fd77b0d20f144f1ed7392a3888a5ba8c8901c43ea1999d2fa33ae250f8d2c9
- SSDEEP 3072:y1dcmWOflYoNLOYcubHqrqXnIRoDghfjfGyfTt4x+NYrv:y1d5WeOoOwHJghrhax7r
- TLSH T17DF3BF7551BCCC65F03F6A3BB19A5A43E60E0E4CA5C5719B34A12D423CB739D630BBA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-api-base-2.0.4+ece063239c-15ed8ef9237ffb28.jar
- Size 28KB
- SHA256 ed2828c21a41e1de67438a0740d5f61ecc1c12258acdb4133938500de79e78e9
- MD5 43a0aab093fb03dbe9b9baf08df10f6b
- SHA1 dcd0c21c75291a996f4dad909a189e9bfb3be6a4
- SHA512 6c7d43bcfc3240f87006989ae7c58601d731bf4c9585ad19a3da8a28b98cba5847cb9717353ca56985d27e582fb5ac5542b07d58566a906f1cda6258442ec6f7
- SSDEEP 768:A4QEbclEJiEUXb5RMyS2xxEM5BEJ1LC+p/YwywWeh:bJ6ExU3E2xxEM5WawywWeh
- TLSH T135D28D28BB8CC587DB3B9E704E558837963E788F2B4506D73038565A4ABF4DCA7021E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-api-lookup-api-v1-2.0.17+11e1c9a39c-17a69d6c84a25cf.jar
- Size 46KB
- SHA256 e85ab48dc61eaac95d2049bb1a5b8d1e92409ef0a00f0ea583e244c38260c495
- MD5 5c68fa0aea197c2edd2b940b9bb311b4
- SHA1 c19a5d36cec91eebb8c9d1b8ff234694c8b95125
- SHA512 f818668bae32ac7e882e4ad097a52bd2277cece3d817c6b00e599ef77136f2b7c9f67bc002e481418704d03325a1e2c63cd4eebc19065a4681e9f1485e75eb7a
- SSDEEP 768:A2LFF9J6QLsuiu5kTRd+SazmvGL8O0KK1MmBX5IwQ/bj0C+pCXxa:DLFFimkVd+LqGL8MsAVha
- TLSH T1B8237D303BAEA563CA3B9F740E414D33D63F685F5F422AC73464D1598AAB60C97861E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-biome-api-v1-18.0.6+c7bd5b8e9c-f9829e1f408471d8.jar
- Size 74KB
- SHA256 ba5d49d53b85a53e720452e182231e626838154161b0c305a1837552eb94ba4d
- MD5 cc539fdf5742d748683f9ac8ce7b9e58
- SHA1 507a938c0987bd042c8d7f58c07d0bc472a92c5c
- SHA512 9a634c60fb1e92b69eae909410e6836f2e085233fc5e2347c5f91c2d0a157d20ba9c9ca5481d27c38ea7ea78dfac05023b9ffe2ac853b6fe0b9e10f565343f31
- SSDEEP 1536:y6RZbnaNsUY1x6qDOxmms3v3y8IHjlhvC5t6ALLr1nEefuxdkwzFt:HRxXx1B//Mj3FQtnEef8H
- TLSH T11873AE7237898497DA778AB24D0158376F2EAD8F6F4621F3309D961E8BE714483852CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-block-api-v1-3.0.3+ec56b6019c-786999d3911362b5.jar
- Size 16KB
- SHA256 04af352a35278b74951efb56856632acc4bc1d1a4436e238a124e44879307d96
- MD5 f31052d198c22054c8f8b0628ab9aedc
- SHA1 e1328a9110891818339b58b59dd90302b8e98762
- SHA512 7fcf9ee31070f9077247a757f1ffc9a85b39f0236252eed15b67d7669903286e5479b3ccd5ed38ba328e930dbb1a18b8f8b2d7ac69be538f953d7a5befd8fa60
- SSDEEP 192:AtWKo+Nd30K+CiFa1DF55f45b7SRN84XHutXJzA3icr2NA4C8o23fS7NxdRcNl86:AtW06CiFEDz5EM8ou/z/crcCffepHRl
- TLSH T1D9723A287BDCD997D47B8B700E024533A73B6D4F5B0212EBB0A9D01E8A6F95827421F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-block-getter-api-v2-2.0.7+ec56b6019c-ed97da8d6689d17.jar
- Size 19KB
- SHA256 1f2554f5aa7c611414f55fc14fb9f2443720364d3622b3d44e999e1281f40b7b
- MD5 5fb8e1b14353e3ad59f5f496a9460ac0
- SHA1 eff69101b1c2a65d660e7d2db964aee106d0719a
- SHA512 ce32a795b87eed791f9a0098e379b1f918590d57eb7999cd9546c50e86a4a5c4ebfba0df6823d3d14c5819842bdad305884e5ecf447e48c2ddfcd7003043cd74
- SSDEEP 384:nCA6s4ebUlj/zi6EN2nDUwx4A7grcCffep4/z:nCAKkIjrREm2AvC+pW
- TLSH T189920924B79CC8A7C4B38E304E219833D63A6D4F2B1635D73834E42B4A6F2E49B055E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-command-api-v2-3.1.0+00cb03469c-48b42f6071031700.jar
- Size 34KB
- SHA256 dead3651770182794807470a109e2d1d06368a71164540e715a918b054d0f887
- MD5 f3071bfacd45268b75989aa27302a96e
- SHA1 9c943e3c7cc23b275bded73f54e92c1c3365bac8
- SHA512 fcac05f0bda0b7105a1cf4c4b369078d9840221ff317acac990647f18d45c713a87faf4e753ee5d5e0832484c386144761399e41f6ec13d9d489f0d5d55aa306
- SSDEEP 768:mN0F86JKYYZkBmvUen/o9D9x6Uy+LYEC+pIFb:mNQJKYBmhw9DL6T+MNFp
- TLSH T11DF26D3033DD9463C8775F318E81C833A63AAF8F6B0666C734B9695E8A67A4053413F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-content-registries-v0-11.+b7a678a99c-4b21446480bf603f.jar
- Size 91KB
- SHA256 fbbf0beecef1b9e70920d2c9fc93fcaa840d620e20dcb91b981fa5af8041dc2f
- MD5 b2cd02dccea7cf88dcea603e80cf6592
- SHA1 6c4ffd7caef0453ea77bac524e996f783bb989ff
- SHA512 87841cbc56c0802fe9752f61daaccc9a5698a7030501de2f060ab870910f642169ba9f22e81f9a5c6dd7f72b24cbf9ed4c5761025f597297e6f81ad4daf5828c
- SSDEEP 1536:VoliGWjnyYZEkyFN0qEfEWImwozhJDXm43:VIiGWIko8MWpzHDXm43
- TLSH T156937C253B9FD057CBF78B340E029433953FA94F6B0215C7655412AE8AEB2D497923E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-convention-tags-v2-4.6.4+2aae60389c-f3b76de02edd3a06.jar
- Size 249KB
- SHA256 76fb95db87a856681fa68f3fcfe5a4c2b49fac18059e46d8a2bb04d59a6d3eaa
- MD5 0470eefb7e7555c1bdefc10133d37986
- SHA1 ac86ec356e98e49fe70276dc09b1e6e5e0ac0400
- SHA512 708484ba92c5785a7da194298d680d1db2b3bab9fe2be1e96e97f8a20705e9445fc77ee853663fbcb7ab0e7e84d25aa51a0bc22e450c412c66e6a969cbee0052
- SSDEEP 3072:G+ur32nRs+8UpNA/JTpBG6vC2gGPNUhvlpHwqiAaKmDFuiAe7u9JVCzLkGJBnnKh:G+uqprpNA/l/Jf/lUhv8dPuWK2FW
- TLSH T13544D6553DAFC0BCC93F6A7809A91D3789077EAEA356275B3500DA80FC6A41C3B911F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-crash-report-info-v1-1.0.+086d547a9c-54d1555af9b0dd16.jar
- Size 14KB
- SHA256 ebcd6cd1fb9c02487d8e56be1fcf0692ca67d7c93507cc5d85a9ec291a0424c7
- MD5 5cafcc3442127ce21cf839b82d85bf1c
- SHA1 02f77460696e34248b5e8529db67fdc062d6faf8
- SHA512 440bcb6dd92aefd30ebda0df47299ed0a18e5863ca43f87a44572eed01f6837aff0818e1c231cedaecb512230967eb3e86be97a2beff37515c16755d9ad5a94b
- SSDEEP 192:Asni5c6p2Px4LAvIDwiYUSA3i1r2NA4C8o23fS7NxdRcNl8iE94Y:AGWc6saLyQU/1rcCffepEWY
- TLSH T127622A3437CC8843C42BDF702E069923B73AE94F170766C736B452299A9F6885F4A5DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-creative-tab-api-v1-5.0.1+d871b99e9c-4e7901f330c3673f.jar
- Size 50KB
- SHA256 982b68ea456a5e755a6ec257c2f5ec164510ebb50d9a9ace17b768c7408f35b5
- MD5 801aa28886823a84822eaae57353e410
- SHA1 530a5385ffc4567db65d8bade787fb3c789a87ca
- SHA512 7143548a3057c7bfc1ceeb0d0999106a9db0da0b319b06af617385e90573bce944ce28a3221468e75071872673b81285909d58a0ce9841bf3967936a38bda5bb
- SSDEEP 1536:iMnXJGAZJ2tZeqniEtqRnOry+YWHT5XMOh2RXvB873in:fXYeFEInkZMJ
- TLSH T135331A38378D8467C83BCE354D22DCB3A01B7E4F1B4ABADB382451665EBB64847065E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-data-attachment-api-v1-2.+aa0fd6fe9c-5e39825c73196ad4.jar
- Size 107KB
- SHA256 a255e3b289dddcb33e4231fb211e0bdbd7460b0082c94e658365baeac6c0eb7f
- MD5 a4273c58a3548378245161f523096fff
- SHA1 cb3f56c98f7f9ce0fc6f913905231b8a6a3a56b3
- SHA512 9199b22ab62e8fff80c097177d944121933666eafa5e4ddbd4e1cfae46333e50029e023d8aa7cd25dd10a3b4fd534bf0ba04d31bfd9584d8d687ef42146c8ef9
- SSDEEP 1536:uQzyUlwi7CE8MBDsL4hP0u8FqV3M9wpMzRF7Su0SQvAW1i1Q0q+SixsP8AwfHm97:v+4wOjZhP0u8qV3NSb71DcpiEUmI/ml
- TLSH T1BEB39D34779D5016C5BFEA304E418833952FEE8B6B0236D72468914ACA6F83CFB952D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-data-generation-api-v1-25+5e56e5409c-8d2403934168d668.jar
- Size 145KB
- SHA256 e11b698dfa87b85cd8f6a87436979d4413736d24bde9c19fed657a2d5c1561c6
- MD5 a29b926315741e326bcaa236cbafdbe0
- SHA1 2272d889839e09551fde60c7d7ec3907bed5738a
- SHA512 e59270133316b2eee4092b7e9d79493042a8abf14162c095e2d6cf302f8003777ef4ace894ba286b40afd4ea0ff5f618f6642ea7673ea0153bc90535ba5ba8f1
- SSDEEP 3072:woShJGjOuWQbfbVwAUb4ewyaRWVptAPr0o87bGSLRrTPzjg0OOwr:wGqufJJxxjRYjAzASSFrTPzer
- TLSH T108E3AE34335A9073DD77CE302E098833952E7A9F5B4626D32455016E9FAFA48BF442EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-debug-api-v1-1.0.2+c792624d9c-b1712d73ad9ecb7c.jar
- Size 26KB
- SHA256 c5031a3f466a22c1258cf94354c253f16aaa302836dbc9833e748fc16af75d70
- MD5 d94731fcc0a26ab1f555f81c2c4db9e7
- SHA1 a1658d190f1aa0a8ea78d844233055a3056a6f9e
- SHA512 8bc0e0547d578ad26d08e1b6526c57cbd72e7a27be39d3a6756b22f7eb9ff1c189dfe70e7ede216480657918d6e7480b51c28de4f1952421a250ae62ec9bf611
- SSDEEP 768:bxkcwvSVKGJqYmIcZtgK9B0yEn6C+pM+Yd:CcvV3f8gKYZIg
- TLSH T1A0C2192437CD9853CA678F30CE018833E53FA98F6F0676C7346411AE8B6F5A867496D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-dimensions-v1-5.1.9+9cbf5da59c-1ffd63707e3c53c2.jar
- Size 25KB
- SHA256 2c51e843031b88743cdd8ad8126f5870d75168ea886c512212cdacc978eaee3b
- MD5 cab726fc95b08e7286d6889b739497c8
- SHA1 5aac488c8db08093139a9ac2b3039c0121336cac
- SHA512 16d63ee87d0d912e5d5ef7b72d5a83ec315226ca37c2585e292fff0f2ce41414af86d054f83b80e9cdbc5bc42ea91ec05bcab5d83dc64501f8884c1e9c06a441
- SSDEEP 384:ATjmT+rgyYwflgs0l8/hEnVC6uHLOdJS+5Lwv+b/ArcCffepTQKi:ATCT+fgsq8hEV2Odc+BHC+pT+
- TLSH T120C25C24379C8453DD3F4F31CE418C3FA73B9A8F270211EB345441596BAB6989786BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-entity-events-v1-5.0.5+06488ac19c-6537c10ef3cf4b7d.jar
- Size 70KB
- SHA256 5114572a128698304f421456b368a6c178f8e7db698ded15efdfdedc64d01788
- MD5 ec29bb57480e055c0f9ac94743d6084b
- SHA1 d215514bd9b26927bb6e522d183028a063a436e3
- SHA512 280a8ed4d7977ca142a77afe4beab39544f634a4dbaaa64a119cd383a950c253e6cc818284405fc61292d10f8e21d694c02d4759af4920473e7a7b2b01443bbb
- SSDEEP 1536:Y9LlsDuwx3gKvKjy5hzGEdM0eLz58rveoJ2cBw7h:IlsDug3DvR5F3kz58TxJ2iw
- TLSH T149636C3533CCD493C66B8A308F296833EA3A58CF6F1112C774961D2A9BAF558D3542E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-events-interaction-v0-5.2+8f57f7ee9c-4024c184ff29b666.jar
- Size 63KB
- SHA256 c3f8a1b32e158ae9f8285127c13bf4d494f441e7b650ca2e02fa59dbc15954fd
- MD5 da3253f75d066ae754f13f5f597a0c60
- SHA1 259fad7b9b312c0f4acfc6194639b731a070355c
- SHA512 93d4dbf77d6241405d538e3c2ffca98f5de91f367093e988bcc5556faf5b5717c45d362f878fa9426bbc3c0fab5811d5baf271908a205fe90137feaae307b512
- SSDEEP 768:s/l5RksvyIAMwtO0+nBgOtntnn8a29Zvyf8X8mAp+5Awo0rfZ69wumX4HLEQwNAd:Iv260cftntOD8EKYAfe8LkNwJY8Bjt
- TLSH T11A535C2437CE5563DA3F4B794F118833A13AA8CF7B4626C774649D1E8AAF1C483592E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-game-rule-api-v1-4.0.8+46a6d00c9c-afe489bfcbd6df90.jar
- Size 49KB
- SHA256 bbf4353420361c1d35234cf08538c198b10dabdd5a9a25e8dcb8cf2400fc8da4
- MD5 7fe48a29b4e623cb075aa8984d59c491
- SHA1 73931bc366a7c8fb6e169ea3734f5c618a57098a
- SHA512 3f634fd80f1d8c967c44da7d74870fd474ed297a1acbd1a5daed1cd1864482a3b05681176b0a72023dbb72191b76867ade7cea2516c3a8d06b1ece27af5ed2e7
- SSDEEP 768:QO6tOo+Fjm12lYSVMPPhwBbJvBimfIyCHCA7e0ZiK8C+p8Z:1Z1FqwfsCJJimfIhr7e0Nr
- TLSH T1CD338D36778E8443CCB78B33CE029877942AEECFAF4666C73464121E2E774A453456E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-item-api-v1-14.1.6+0ecb053f9c-df445d483e850990.jar
- Size 67KB
- SHA256 10cdd8b62a0beff5de870f8e8d4eb032a94d6fc446dbd20f8ce10de81154bf9a
- MD5 d1a2dc9c47ea364c9ddb7eef1030d656
- SHA1 84749579f2fe4cf221d5fff11a3b132baca59e1b
- SHA512 a731cfaf5006fc561c7b8a5d6e7841bd5ef791094c5d55e3838f14e946e0ec8e1f745f7ca8e22d7feba0e6e282aef34b7545647a7734fb552fbef7dd2f44846f
- SSDEEP 768:NJyH1V+ydgObOCI19JUKuUajk31Vxexs15F43d35dEXLJ+5MYzcaaOj3RDQzCYBS:eebYuQ9jaMK7qtpdENSPzRMQZ/8bC
- TLSH T1CA638D3477CD9127D57FBA704F025C33612EA84FEB8126C33064532E8BAB6A897651E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-key-mapping-api-v1-2.0.5+e2bdee789c-79bb49f53200cb89.jar
- Size 15KB
- SHA256 3ac3613c428a5c9ba647b2f7529985d2218790560d16dc5648526080fecb99f8
- MD5 768fb7e52dee793fa8969a2f3888be7a
- SHA1 9ad6cb742dc077f34f81e86c41f1c62698fb29d1
- SHA512 2dfe9962402f0950fce3725d9b4aa152873b0d2fea7a8c05e06d971f3f07f81ded6d90b2865890e73f370b13680d89fcac411dc105053082816b8516c6a45201
- SSDEEP 192:KklYrURJ2bELZiT2vG4Uy6MaTKdA3ihr2NA4C8o23fS7NxdRcNl8ieFHcO:rRJ22Zib4UbnTY/hrcCffepeFH
- TLSH T1E172F72473BC9497CC3B8F744F01A833663BFA4F6B0226DB3419516E5DAFA5853086DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-lifecycle-events-v1-4.1.3+4575b05f9c-f10466c87cc0607c.jar
- Size 95KB
- SHA256 1fc939ef019b78f21527fb468c63127218269bd92334b268bf9396a03d140200
- MD5 1a6f843e906659cb448b9daa25dfa7a3
- SHA1 38c6d6fc4e7b518504e18b80675f39b6c4449e7a
- SHA512 bb5a4c3c091ef28ba75020714a9890f1f0d3fae474f9dfd68507a8b124b34b8a48c9d0a10f8b0055e14fdc50fbceeb7c38c414d769c9c0ed6fd39c0a54b782e1
- SSDEEP 1536:GsuvyP0cGDauHtdmGU5AY4Cd2VGpvrGycuu85+ZGokVFXf0Eqiq357e:Gsu6Mc+HbdU8Cd2gpTn5+BSR6Y
- TLSH T17A935B25339C5063D677DE3A9F648433657A68CF6B1213CBF8A8084F8A67698D34D2D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-loot-api-v3-3.0.17+06488ac19c-cd634c00986bec1e.jar
- Size 31KB
- SHA256 80a9c0c2ed40ca2869c4c22a2e8a98b9e83e5bf9d055d6ea1efd1876e4e3e34d
- MD5 d3ecba6e3a054308eb6bef9415ce66a8
- SHA1 e83fb2271b627675e5598364257a824337d8f04d
- SHA512 91cb7721c23bf51b4132b2d74f8379afeb3ad07ec72c83b9750789b75301e9fc42a87f126f4afa97e065e45809a0391c5ab498b0cc5c432023088b8be09cd1e0
- SSDEEP 768:AQ+H1XOoJrlWQzh1Y8a8CABjIrJulBC+paad:WH1fzh1YTY8J3od
- TLSH T124E28D2437999403C967DF300F828933A22F5E4F37473BE73469619A876B68C53952D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-menu-api-v1-2.0.16+086d547a9c-dc6f74ce9e01354b.jar
- Size 23KB
- SHA256 e2240d5ff636a71da1e9cbfd86411569ecee6ae92fa068b08d7680f193500785
- MD5 06a45b37e3c52024627218447ca8f5ee
- SHA1 2964e0a8f72eecffd20c3475f0b9de6654758ab9
- SHA512 1f6fd6d57ea602a37399696d373aadb13a00be5f423fb6e31ae59413a1b3dee7651aae426c4b0e2b4ef63ed6075e15ede151458e9e620e8a5c29e2d245375b51
- SSDEEP 384:Rj8VEZ8YAmJrcHPQ/TZDPD/VNKKHECE2r2R1NCz9qG0IaOaL/0jp0Kq7I5MrcCfJ:RUk1lcHPQbVD/OKkCE2SlCxf0IOsjbq5
- TLSH T1B8B25B7437DD5863C47B8F314E459C37E52BBD4F2F0B26C72428012E5EAB9A897841E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-message-api-v1-7.0.7+086d547a9c-c145f4f1e62f0fe0.jar
- Size 38KB
- SHA256 d91e1d46a61a5f013f6d035dfeddefab29712bd54b71036eef987dcb983c1c5d
- MD5 3d288e9cbfe21a55dbbe8820de08c54a
- SHA1 c770df201489364d7646556b7fa4c07b005403d8
- SHA512 ae3d697df6f03348d7907bd6edac5a9a9ff41f7ef562093262b412415346e092ad0d340580bd42cb4e62e1c14c0eaed5ada0b34964bc5770f487e0bee14fc581
- SSDEEP 768:1D3DqKP2dgIFmi53/0QoksVlrVkvyeAqtN3/vA1QQMK2geZ5+8bBt61XVLTNC+pA:1D3OKP2mID5WlCz3ZwVgrF
- TLSH T15F03392437CD486BC9275B327E80B833652BBD8B5B1636C3B1AC115F1B67AD467483E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-model-loading-api-v1-8.0.+c80601bb9c-898038b14d51841a.jar
- Size 85KB
- SHA256 e5efa50aaf7b0d1f13d1698b20ddf12c8cd67a83725333a3546cfa6189cf5061
- MD5 9d46b5230ad46d015276d25ea46e0551
- SHA1 9c5f9e06c43b43f3f8824ed30dcd9d9189e60c22
- SHA512 e21e11a9ce1c87eb1dc2c873f3dab5124288f0f9a5ba57d8d8331a31573b958912b173c4572fd53642c64d295decda0516f46d6b964c8c4e4bf8b57f7401247c
- SSDEEP 1536:V+JZ/adKLdhglJL/Qpl73QmadzrGMAwVkyHsppCuds9Or3z2ebJHTGaOaN:V+H/adKzglJL/uF3QxdzEwuyMppC92b3
- TLSH T1A9837C2433AD9467DD6B4B309F458832582A789F6B0236CB3678505EDFAF254D3843EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-networking-api-v1-6.3.3+72073ef09c-41075dff995480bd.jar
- Size 220KB
- SHA256 add778c6e7a73c4ad2352402be0a98184437a277ce42efc8ea1e4df1bf80995f
- MD5 4bf2d72a594f426a20cf7b06ddd98572
- SHA1 67d820af9cfc9a2545ceabbf737cc840f2f969b2
- SHA512 df9f04e23b57d9ef7519441618e284700eafb227d925c32b90bf98c30e97abdf12356493837715ec4b167cb01dcab84fc19e083f8e0e1da221d20736e131323c
- SSDEEP 6144:GPk0fTfbKQlFwJCyqNx5nqy1ARam8sJ9UH:ELD7GCFHSRam8Oi
- TLSH T17A249E21335D507BDA378B324E01AD73657EA88F5B031DDF2479128A8BEF15857682F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-object-builder-api-v1-24.+46a6d00c9c-2ccac7d355e7fdfd.jar
- Size 51KB
- SHA256 caa777058a7a6315659c0a906176459bd385b9300da5b87af6672e4e12e92670
- MD5 2f23c8a7b6fd0833b773aff8ee751f60
- SHA1 0b4e3940635a29873ddea049329583951660a031
- SHA512 f336997a8f39701dd5e629f2e25af381827c7b29d0dcb0d95185e304b2edccab20c27ae1a0d3a03d465566dd102737121657dc6577de62016d50beb3d2a5bd94
- SSDEEP 1536:DEnfbtp/aZKfCIX1kPpH2dG5LIu7oZwqQtg:DEKmXItFL/Fq7
- TLSH T1FF334B3037DE8457C42B8B308E254D37E53BA89F5B52F2E32499C16ACABF1505B522E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-particles-v1-5.0.18+d1756aa99c-2cc85779f33b32b4.jar
- Size 50KB
- SHA256 3520f53bac0423033b70695b5a2d382286b91e2c67c3dc95b767a558865e9bef
- MD5 6f58e12dc5dc203984c3c9684ca9011d
- SHA1 7fabe818ae478ed5e916575722df33f231540448
- SHA512 f5e7e2d2f989b4e44b53936fd251da18e01b4d99be0417b22ab110f74644ccccbb7bdf20af75fad4c96e7e1ed795cacfdd088b502edfe1f26d659a47abc68fd2
- SSDEEP 1536:VOhYGsNn5X8PzMuaauNOT5KGlnIJ9l5Sg/n:UYGsfX8LMuHJ5KEIJ9lwG
- TLSH T1C7336B2937CFAA73CABB8B758EC08833953E3D4F5B8715E77464410E4A6F294A3452D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-permission-api-v1-1.0.2+7c33558a9c-6c91792be0c13e9a.jar
- Size 38KB
- SHA256 ee30369f23011d4e856e4fd378fac556124217d57df5551464dd2671d74d098b
- MD5 084292ef4f404fbaaadefbf2905f187f
- SHA1 b99767fc91eb7baa6d2bde58fc65e1bd830c2522
- SHA512 4f466fc9fec3a6085d42cb5bad2af023d838730b92be9e512dc2cab231a05f7ec66b455e016ba887e5460db5f9764a5d84736b79452f427160cc5a2f8df66202
- SSDEEP 768:A1yBvDMxbSMeGI1Tn0ptEpaO63uGX/lbfwvCC+pOMvU:OyBvElePb07bsEU
- TLSH T1FF038C26778DD173CA3BCEB0AF304833A53A69CF7F8155DBB078015A4E9A5D4A3442D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-recipe-api-v1-9.0.20+11e1c9a39c-2556ccd28a805ab4.jar
- Size 90KB
- SHA256 0dbe9225b8bfe7eb93c953a4fb063247c024bda3d011b242b06dac3c07eb157b
- MD5 93adbc38da261413fe7d27d2d2184f97
- SHA1 a695ce6130f1a98fcff93f3cc81fc563d3596ace
- SHA512 4db1fd16e5cab9efe7376e774543119ddd2febe039a017cb442659fd0f918983e01f9e4cf2c5f8e9b093c487b20eb236a4be32cc9282d045f9df29fe6b80baff
- SSDEEP 1536:dfcWJcr8sbo9sHPTe59n1MNRa9LgMnnA59X20Pe9gxD:tee9Z59nOra9MMs9msOI
- TLSH T166937C20779D9453D877CFB1CE43983B902DAA4F7F0225C7B9540A1EAEAB554870E2D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-registry-sync-v0-7.1.0+c7bd5b8e9c-1837e59087f30566.jar
- Size 115KB
- SHA256 3737f76322e686d709b5ac85b2ca7e75257dc2424cd5d8d5c9749c0803f9ac24
- MD5 f8f9673acb53479d4aed270930453b11
- SHA1 7e0062898c97a82553045b9057634df510f2b8ff
- SHA512 7ca01b6ac975c47f754cfbe93849934d9fff9c28039e133cfe24548944ef8047a0b7d7e59dbf3069b42c48694557690a7a0973e81efc6750d455218be774a860
- SSDEEP 3072:V86/CfJpPY+HX/uo1y/PZ5WEcR4VUUjFX:V86/CfJpPY+HPujPKb4xj9
- TLSH T165B39E287F8ED113DAF79F389D018833903FAD8F6F016AD3615802AE499B594D3166E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-renderer-api-v1-14.0.1+eec4cc519c-6b2ce87dd6b5c492.jar
- Size 118KB
- SHA256 2826c35ae58658a9c8abd8e28383e69f7c776613189dc2129c8089ce41313439
- MD5 de08424d72e326f45063b9717678b33a
- SHA1 f8d2379a7862d061ed6416e8b0d03958afa20902
- SHA512 9db54ef13f80afa572441a797aedb16f1866846a83e854d3c052aa1760edb3691f0cdbc3e1aadbd6a7e8c7cfc8a6d0dbb5cd4dc51e8be8213de8ad7bc646625d
- SSDEEP 1536:PGv2jyOOADfOds9ghjQhkRhWw4R0yIEOq9EpC9pv6XSM069yfSppP33Uxsaz3zf1:+GNOds9gJQheWwMtOBM6XQ6cqppP0JzJ
- TLSH T171C34B60B79E64ABD86B8731CE018C32542B788F5B0E31C33568417F9E6EA64578D3DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-renderer-indigo-9.0.1+e73ab60d9c-37c49569f33e44c9.jar
- Size 88KB
- SHA256 733102092dc16d6cd40af062a7a560c513b4cc207e93dcd52fbbd2ed17900929
- MD5 d2305c450e524932ecd760e1dbffe3f9
- SHA1 a611bda979ee626e98b076d73e64c735dcb4c969
- SHA512 6c13b4e68fbe3cf4c5e677e98b1ccf6698a5fbc1531fad7acefa07f32712cd9f9063f27e6fbf4077b1e7993ba86291ec268ac6344d23697411596d37d423c8f5
- SSDEEP 1536:2ZtmNv5ySf2bRJUQHwesjhW54K3Je0EM6hQN1sGsVfgER0lgYf7K/iYCTl/2jZ0L:ct4vWbRK7vKobQIGsVBR0lgiwdC5JL
- TLSH T183939DA4738E60AAC9738731DA819937853F684F534F35D33AB4903E5A7EB2183497D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-rendering-fluids-v1-6.0.4+06488ac19c-7742a631bb731782.jar
- Size 21KB
- SHA256 d3afbfe0a328c9ee39d6565c7e467f0cf9acf61c543da201647214965ddc998e
- MD5 0ce123244bf36ed402a106ee2be8497d
- SHA1 47165103e22bb624a96926259ad2b7a970a66765
- SHA512 ab2ca4b15eef0fe5ed374a4f9cec9e8a280b47cf0c56b511aa2b8097c1b860979faf920b1d5d851bfb637912f41162d328d1c7f6f8f6b68c683ba2e19431a968
- SSDEEP 384:uopaXzFTrKwscRB2NQVuSeF53U/jrcCffepfG94:uoAFbsc2eaF53UEC+pfG94
- TLSH T1D2A20734778EA497C93B8F708A458C33912B7C4F1B2A72CB3425415F9E6F2A45B083D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-rendering-v1-25.1.6+46a6d00c9c-1c943a8cabd94571.jar
- Size 179KB
- SHA256 9c79782e6a4a99f25ce69b36b3e9321cfeb2a0e348f858eab1e9905313ba686f
- MD5 f6253a6a9a2ddecfcc7b5a8e4d1c22c9
- SHA1 f0c37b490fee3dea36f4d64ed82522c589c264e3
- SHA512 f4e65b14c0133bdacfe3a3c08c65d133b6466858f3a28c25c84a976e4a85a66a7fb3cb3ad1181ffb135979deff04ab349c72478dded975a95a33ffc0d44653c1
- SSDEEP 3072:xB0U/7fWN0ZAcxwb+BRRRr34aUZ8w0/Nw0A5R3UqRc740aUh:xCU/7PZxWbyjRrNjw0kR5RQfz
- TLSH T14E044A307B8E74A7D96B8BB1CE058C37456B7C8F6B1A21C37964012FDEAA664534C3D2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-resource-conditions-api-v+10e9a28b9c-1adebe1bea25d732.jar
- Size 54KB
- SHA256 b567d4aaee6812771ef578e757a3be1635b1d2b11e49c4f700238a0f885cb8ee
- MD5 8d83e01f5a6a7a055b1b987367edced5
- SHA1 f38f395e3a59782cd1b13461bb8f2ac4b103a39e
- SHA512 31e1724f8526a46c15a8c301e9c41e8431aa97a33a0ab28f4b55e0f23ea28c4842f2fe9e409867c0e37ba14529c012e1f4cd475dc90a6aeae12b80a4b74daad8
- SSDEEP 768:A7PcPrQgObJDLUmkwAm3duADx0sOx81K6Y9xEpKuNx7J1Aoc1ZC+p5sr:qOtWCwiAFIx8ozWPvNZDjr
- TLSH T104435B3337CD9263D03F8A304B850537A536AA4FBF1D19C764A6502A47FB294BB4ADD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-resource-loader-v0-3.3.20+4fc5413f9c-5f4321ece30599a8.jar
- Size 17KB
- SHA256 c0482b961d1d57c55b923c5425371b065546565544b8c18fb6d4f8456aaaa8c9
- MD5 3af707464206a320218b5d2f0187f1de
- SHA1 5e2bf8e6a93e3cdbcc0e4661817dc9267f1640d4
- SHA512 2a96f5dcec5eabb32981e1defe4dbf516b312ad72b7318d3e4241e49694f0ae22dcdbb44c7c21f7b3b2ce2ad91c26e7c66881c7c80b23b5e4d6fc979eaf2a7c4
- SSDEEP 384:AWE90pxssEfUIxk8yGuLru0n4LH4/JrcCffep6i:A9SAlk8CufH4SC+p6i
- TLSH T1CE825B257BCCD593C03BCA321F018C33652B5A9FFB2156D7A869100A8BFB285D745DE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-resource-loader-v1-2.0.13+9edec1269c-2d80098358c60026.jar
- Size 130KB
- SHA256 62867f6ef2d3648e1c1d13945f188e1458a32694c213feda1c93a1ab86362369
- MD5 4459bf54ef62a5dc17a5d13c5d1c3d8d
- SHA1 e2cdb80a700a57408b3b9afb40edb3d44be741eb
- SHA512 538615a73b1bb514333716d0bc58a42cd2f6faa4daa301070723838933053d5f4463c1b38ff58ea3b8d66f05c2dc16c1b4425550483bfdb887f6a4f18a4925b0
- SSDEEP 3072:frwDgbslITb0qNpqCGmVKrT5YvueiGKGkSt7:frOcsGT7NppGmVKmvTitnC7
- TLSH T19ED38D76BBCCC426C43B8F394E41883354296B4FEB2625DBB424010E87FB7999346AD7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-screen-api-v1-5.0.3+086d547a9c-5bb2010fcfe00172.jar
- Size 52KB
- SHA256 1c67bfb5ad7af18377ef69599139d62314962041e2f9c4365bd007a3f3699b5d
- MD5 ee88bc5fd96356b39002683c96abcec7
- SHA1 208c629f07a6f6cad03fcb4eba45120ddc53ae8a
- SHA512 20fd90759faec6d508da0bfeafc58bf541cc6ad3d5a18a9377a287722cb7afc78b300738732bd9385d3ac02a37873e712b25360bd9d936fa43da9fed367512d9
- SSDEEP 768:wcvQm+4RFs0XIas2LBntcI4IzabfNdSpQ45DvgzjAbfP8xRkp7c1UPxIHC+po0DQ:ry4RXLltcMujNgpT5L3fP8xRkKaOQ
- TLSH T185335B70378F8257C8678F728A424873653E698F572636C7787C11AEEB2B34493583DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-serialization-api-v1-2.0.+11a26f319c-c9067a3bb12b97bf.jar
- Size 18KB
- SHA256 58e59a38e33f8e96d2e9d3e821520db5021605e8698cdcbe4d10579cc3206f5c
- MD5 0dc3cc51c2a99110ad1c3de015a82081
- SHA1 0da9ecd38873a6e862cf8e2a6ade9861527d5ce8
- SHA512 22d99ad3e00eda6ef263b80c5d6fcc99dfdba8061695e6a0d333159394ade84f3b4481ffba90b73180d1817847d08518908128586e08efc90375eed6c7291515
- SSDEEP 384:APTP18yaMj/H/xIVv111VL3/XrcCffepNye:A7Nakf/xIp1FAC+pNB
- TLSH T11D82197877CC4A43CC279E320E418837F23EB98FAB1555E73494112A4B6B6C45B466EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-sound-api-v1-2.0.5+11a26f319c-c9e5153b03c32add.jar
- Size 14KB
- SHA256 43a8729b4137429d68f12964f6a69717bbbf92deb0806864709fafb0e70a0a52
- MD5 71182f901495081d3ced556d3edcdc76
- SHA1 665549b6177121a8415e467b526da01d9338efdc
- SHA512 6c93f892851773197c4771c003bfea3b1439e9a5876fe1b44b0292c1c858e57f03bf6e6d168ec4c68dc7b4d9ff46508cc952b205ee1d3b2f464e4f18e7f4c8e0
- SSDEEP 384:NLA/znkMe9o4Jj7zF/bw6+AP3G2rcCffepnIA4:NLAbkJ/JpMbAvoC+pn54
- TLSH T12A623B2837CC848BCC2B4F308D419933A12BBE4F2B42B6C77454515F4D6B759BB466DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-tag-api-v1-2.1.3+794df31d9c-68520ddfd5bf5fe2.jar
- Size 46KB
- SHA256 813bc0597a5204d8b50a00107c2653f0446710e1cf54389cfcc0fa09cef8336b
- MD5 6d6eca110c0b52b98e438ba5dcede17d
- SHA1 26f56ea7523999ab28e5e85c8d18e5331b8bb6e3
- SHA512 20a9c65a330f30162342b9efc4e8f1eed1c6bf4c72a12a996f1ec596cb79c2096a1aa891a5d314b8d894a71fc931481676d12ab9944acf003b6ae9edefa162a5
- SSDEEP 768:BOB+hjIMdqjeLt9MeX91bTXRWaBngVf0+WtWARaAhYiC+pQG27g:oBwDdqj89zRWamVc+W9aAG7Jns
- TLSH T147238E2437CC9433C977CA394F82C473D92FB85F6F5269C77064421E4AAB28967852FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-transfer-api-v1-8.0.11+39b5a3929c-d42ddc2722095dc8.jar
- Size 188KB
- SHA256 656c46a550440a21e10e23d51b6e3501b863707576dd332240c5ee6c20f88d9d
- MD5 547fe854988a254b15c06fbe5885e4ab
- SHA1 4544572ebda953bce4c8db9895f0a9c00c1e17d8
- SHA512 90c85866741eed8f0a22762aaf9c5cb228875751cbf7a5ae539f707289e1078f995b05df8200f1815ae2c6f53f4b418d79d3e02ce347aa2d0c632b99bc33a083
- SSDEEP 3072:lijYpsfNjedxTqeMtjjYPzHdo/kdehGjVzdQVX1VVsdl3MBFVluYl:l/sfNj0xTqJVMzH+/jUj9e3qlcBFVgi
- TLSH T110149E343B8D5923C93BEB344FC25836953EDA4B6B4536CB3468419FABAB29C53811D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\fabric-transitive-access-widener+e098252d9c-2d88b08498f987da.jar
- Size 11KB
- SHA256 22c78b8340e201c3edb5b6f3561ac01078a27c3b65a2efd3bea464dd4504f2b1
- MD5 6759d477263fb82a50230b97de9638b8
- SHA1 3683ec698a0ae2c6aae0e70464ac0d39bdcd9ab6
- SHA512 8103e3163ced1e479cbbd40d47ad8f1ce4a6cf8a0a87b659e20040b9d414f06864b4eaea34717ce7f5d91646aba3699d117619e4b84ff587fda6682c9df5c9bd
- SSDEEP 192:Ab577MXQSsVS9x0tNQ1wnr4VgpdG5mLS5I9kKgsiUYA3icir2NA4C8o23fS7NxdX:AV77MXQVS9KmUr4VgpLS5Ia/drcCffei
- TLSH T1DD32AF0033A48944E93ADE344F568507F36B6F8D9365D3E7375C60270D29B6BDA10DDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\io_github_douira_glsl-transforme-3.0.0-pre3-a5fd0f336ec8f100.jar
- Size 713KB
- SHA256 92531f3ddada790c4be93fe45d9908709be5ee4ea065ad770511342758fd7447
- MD5 f0ef1777fe0983fbda9277afa2e8ac95
- SHA1 6230ca596f7d611c1d80e40a8d00f147fcddd4b0
- SHA512 5be74f62fea6294832bf8737077e81ae37f7de6cabe232e8c271e0cf32ae7805f5f5678692738199442f2b00d527ace126b7cd653686681e0544a9acf2792e7a
- SSDEEP 12288:XLvHOsDQADGG2u5I+kkMM/EDHSGWMCGo8eJLxMke0nh5e6Dt:XTuMUtkMM/EDBWM0ske0nTeg
- TLSH T1A4F4B077F9C08126CA53F9B1C6C0A763ABBEC1D5D177A1EF3764018A86608495782BCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\lambdynlights_api-4.12.0+26.2-d80401de09bd50e1.jar
- Size 193KB
- SHA256 cbc1cc450456813d0c26d3c6af97f1d6d8d435789bfabfa22c934ec36ac8f98a
- MD5 739dd158bb132919151737d4dac0c42c
- SHA1 4f7be3742ca7f94cf3aadfe48242cc7fac755d45
- SHA512 d941c242f577047f59de1e5dcc0b1665685685a86a8f318d8407a36667a39ea10d1a8894521d1d4725a409db828860ce0c592381f5d5c9dfcc14d5d817bef107
- SSDEEP 6144:94cnWQfH0cSqSt5p5Wz2P5TtkcGuEFQKsRG:94MMchSTNP5B5GuhKl
- TLSH T13914E075A1C989DBD5BB8D7A85034C37568B13BCDC8B165B52B38E038BFE78C590A24C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\midnightlib-1.9.3-5558875d7767a14c.jar
- Size 58KB
- SHA256 2de0991c14eb66825aa77cab4f4b0ef7fa8fb8f8e00b6a99b6f92a8c37e58e65
- MD5 013bb2486a6b7c90fa16c70e041604f0
- SHA1 150ef19c168ef022b554b4c05bc0fdac13fcb2c3
- SHA512 46a0959737bb54431f0ae0a7dfa2467f26211d27ea2cd1ef7a7750c9a97425f481db46bab6cc861cd3b77accb7dfef3653dc5c683d7dfc07fa7f76824351ce22
- SSDEEP 1536:EtMa2hqupN/aYA2RYs9FPZ762/qkpk6fW7HAuT:2Ma257/adxs9tZ762/fkoUHAG
- TLSH T19243AF7B29AD869EE537BE77C54248033916239C940B3A2F3D5937605CAB9BC53013EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\mixinextras-0.5.4-edfcdd3df0b35281.jar
- Size 710KB
- SHA256 bd79ddb2f54b39a08deeb50cb12439bba01481264dd5a9f5ea830551bfef31ff
- MD5 d5070aa9700de60274a740d4c2640b4d
- SHA1 5e167154bcb9942111313a5e186e16cd7265f858
- SHA512 31b929374c2526ebb532185cd54b752c0a5ca7f56a48c99ed6a73f598a4155c9db88ab4c8ea5904fa2e2f78310424393238b2db6cd435c0f3ad87d1391ea3320
- SSDEEP 12288:W0yJcZYeBFMvTXXZSrnqF5fDEobQm9lz2UiHIVSA6qq0Pc8xWyqR/6ZO6342:4vRvzXcnqFZEobQRHJApq0PVxoR/Qpo2
- TLSH T110F4C02233DC46F5DE67C1B392629137D5290AFBF4062C42EE981AEB2C7E5490F79748
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\mixinsquared-0.2.0-928210a9dd2fedd4.jar
- Size 80KB
- SHA256 16dde85db0a30e2290452f5e452f2589e150bb551a54820f87b5084235421d19
- MD5 f2952c777a6f01c713ba58cf862cd149
- SHA1 2293fab688a8a15cacbccd5c5e6816e532b67a98
- SHA512 f2d15e2f7c90110bce7bf87d185b79aa1a3a71a326c9ec93eccec07b4b1568dd6a45a9602f34bab43d933345c2b42f32fc675dfe93a953bd7a7c92f8ae50710d
- SSDEEP 1536:D87Vngi0Ep12BgNUdUcjLajj0duIz0hX+Yhozi06nlZz9x1XW/WKklfFtXwlC:DcXp15UHL04kIzMukHD9XXW/WKklfFND
- TLSH T17A83B0BEFBAD763DDD2BF1BAA4826533767C4D6CD237252315F808C3846A9BA061501C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\net_lostluma_battery-2.1.0-4b6b4d294938878.jar
- Size 42KB
- SHA256 f0b2967facc6728163e504dcb557b11d7fb87e5faebeb786bc96301660a6be86
- MD5 756c275fab6e2380be80d58ee49fa244
- SHA1 6472d85cca02c67c024d493b19ff4cf5341ea429
- SHA512 c10304289ef2be5c5b83861530bffd87cc16530a186e082e4380c4721488256dad20ec45ff1dad45fa9b6d50ebdb8f1e4b2e0bc58c5d07d123456d25f1aec23b
- SSDEEP 768:SmeC8XII2kDWdnB1cqqehuzzLx2O2jWAGvm/XES7:+IdGWnBzqFwES7
- TLSH T1E4136DB8FEA8D453E777857882717223E80FE4AD8CC79183705494AB4DFE4410B9A6C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_anarres_jcpp-1.4.14-ae60d2cfc52c368e.jar
- Size 74KB
- SHA256 1d115a6fd07ee28db7c33b87c41e912361dd037fa8e5202ccfb4ed264d668d54
- MD5 1e1b0259f6f99c2582b6c94b2b2a4487
- SHA1 31f6569b56bb4348f82d97d27759c4ac439b8fe2
- SHA512 209ac8df00ee53956e4e2583b6de2a8e8c468cf626f7e0fa730055e6d980ffcde4db8fd1b5fdbc7c1172c9a519e0dd5c491022efaeeea4ecd4ab8f9e5cfa2877
- SSDEEP 1536:9DnWEXdUAAxhboZqEqaDezsMX5YFDaucyPH14AeAftydrJ7iD7:5WEXdFAffEqaDaXEDaHy/GAfyt7iH
- TLSH T16C73DF32DA8C8D35E00386B750B5FD015E7E3A84D6C610DFD82B9235C7B5E2A9722A87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_antlr_antlr4-runtime-4.13.1-b805d86546810326.jar
- Size 322KB
- SHA256 8e07b800ff81b68f1581af6d5fc3f2f376889ec99f4946bef957914a5b4b4631
- MD5 5860e5de90e50410c47dc529818b1033
- SHA1 54c1b866edd89c3b87cf5d702b6349dec76d7ccc
- SHA512 f7a08d97669c9e37b12a7aa212ba581bbb6334b3da31f2654466f9eabea4f285f6a05cb95189e0cf1d22a79518bf9c87edd00580f4bdfbd89062142836494188
- SSDEEP 6144:2drtM06FEMBkdyCrGT0qt8D1AH2WXXqJnU1LPMJ/r85berzGiD5zA:2lWqMBmJrGwqti1fWXXeU1L8Y5Kvbts
- TLSH T14264BF25FEC6C016EF035231F9677D96A27D44DD6046308B3F6A0FD6B8208A9562BF87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_hid4java_hid4java-0.8.0-a0ce86adad2a7d62.jar
- Size 924KB
- SHA256 730e6659174236bba8996b344d0cead0afce93d4b87504ce3f58dfd454f4337d
- MD5 f30bb5ec03d0570d96d3e8de5523d3c0
- SHA1 6a21c7fe0ac628e122e83098a163574883aef71a
- SHA512 41a156f884da52baee7cdd28eca21749c47961c0429a44558ddd2b0fafc4495ae12b29413c251904e2311841205c2b2878c5f6f0638bc116dc4c986a52a9ef87
- SSDEEP 24576:8E54jh9u9XiG8nw9Q+RsydnwGbURgdsVxJna1anwQus:8E54dc9XiFwBBdwiUyUx9uawQj
- TLSH T1A4152337DED1C060F48AED7A29DDD203358A2995E6F3A2136B3014EFC96101F5EA69DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlin_kotlin-reflect-2.4.0-5df91ca4b0e86857.jar
- Size 3.6MB
- SHA256 4c75783a8ef0db07dd107397deb01b95c9914d359630fec9babfaba9ebeb1028
- MD5 cc7f5468220b4e26a02dbb5da5465694
- SHA1 c87386ca9b847894c88fdc25b422211db2b55a73
- SHA512 794e09343048f8f54984824860450e72ca57573d42fa5650f9d9af253f128d12d61245244a1a6bd3378220ab3ba24b7cb4972a9e97772e6664737b6ab2ecdb73
- SSDEEP 49152:iiVDQnYnF7J5jmxGwzuWtJ3yWDZ8qFob3ePqlu+xr22W+nARBCdm2CgH/f6LJWhQ:JDQm7JYKGyKZKjOIZx6KAv2jH/f6Y7M
- TLSH T10B06C02A79F1FD50C8A794B192C09876982602CFA467A00B55B4855E1CFF7CACF25FCE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlin_kotlin-stdl-jdk7-2.4.0-6c50ed69a61ccffb.jar
- Size 1KB
- SHA256 883279c275d18f6780793003fef044e0438d4d653d1d619ffcc0f6c41396a355
- MD5 58e4e5c1197f5dcc8e1c20c1771d3e9a
- SHA1 5ee4941d842f31db1af7bcd6925fad6e9bb29a16
- SHA512 7f407d1817866e01d06c42e7e2cd6fdadb437df7567ed659aa3d2d3658ea2d3b93023395055f07f7c0d6cb5eddb89f192f46c232885702599d43280911fad54d
- TLSH T13B2112303ED8E96BE25E47749790F05AE736464C060C66471A4868281EFCD854B90BCA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlin_kotlin-stdl-jdk8-2.4.0-c228fa2696a92a18.jar
- Size 1KB
- SHA256 64a104013824324649707e04cc00e4cffc483d7e068c6b872cbcac666f609da5
- MD5 a473b5e34106b250ad8f29b5f07c7e2d
- SHA1 aa8bdfc7320123c67cb3f350914cc13b47aaf264
- SHA512 bc96c5cc9f77bc3cad7a5493653ec9a3ac997ea5d04e87bbd871b5e68dcd38bab1d2689d42d389a61c16feab157165badefbec6db792ceeb8442da5bb98cab3c
- TLSH T19721F0303FE0C89BE51F9675DB40F159D337A59C018EF2871A440C249DED84D4B05DC8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlin_kotlin-stdlib-2.4.0-b7c44403154bf922.jar
- Size 1.8MB
- SHA256 5318b3795efdc5300599ef48d4ac5b26c9406fae3e45ab240e8368d09d3a6676
- MD5 687e48082a629739015629414e355c1f
- SHA1 d520d2216c1d99116c8bbfebd55e39e26a608549
- SHA512 af477bd06a709386e63658aec6473e39d430e50169d5846c078c5f14bf53ad5e64cfcbf15fa5e25a8d01c49c2126ab38c214177148eb1c9615a4d967070a7b2a
- SSDEEP 24576:jcrKnqGqAivgoXZj85fa5tw0N4y1iw/6A0Q2R4JQZxrmENO3Sj/iZK2rb41LbPZg:jcrOTqEasBw/1JsyENO3A/iZ9MgJ
- TLSH T15E85F13579D1DD70D16778B18341A077A82E83CFF04B6017AAB00A5B68FAA4DD316FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_atomicfu-jvm-0.33.0-e348aaa397d08812.jar
- Size 61KB
- SHA256 843dd749ff32112956dba51a57923ad995900665d058cb9c90d44cbeace7dcdb
- MD5 8c9413bce80c2a2e626a3e5cacfdf2c2
- SHA1 b49494ba1a8cda42e9eaaadb748e08c8c174d8f2
- SHA512 23450eda3938fd6039f6cc3829db40415e59baff415790545268bf576fe2c8df33255fcec0344e6e6f01ea3eaab2d4380aa94470aa2f063b2f57794e12ccac2a
- SSDEEP 1536:yv/PGDSz0+igxpXutfnGIfZLB7sNHBFHS5bY66aT:yXViOut/GMLB4NHBFHS58kT
- TLSH T14B53BF2C3EF9C4E8E517C47446049C3BC45E66CED1CA62175E9284D22AFFE4D93A2AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-co-jvm-1.11.0-e44c0f0f4a5439d9.jar
- Size 1.5MB
- SHA256 14f5a46b344ab7420d35ed618ed0a483687d57b23470722b6568f1b643f001f3
- MD5 53b5dc857cdb4bb9df168e3b39aecc1e
- SHA1 576435b43819be284202963a5afe5e34208338e8
- SHA512 1cf2aa53686b02e6105c8dea73dc684b87302630eaabe0e2d80a0895274c8644e3ca60afcc2018f4962b9c138fa17fceebf5b3ee45decf02b37a790c33ec48fa
- SSDEEP 24576:PmSaceDTVspmSK+IJ+cukinR4paJbNGrG1xGIkcrmZ0JzuM:2tspmSK+IJAkWmUJbN318YJzuM
- TLSH T1F175D0B1FB98DE30E09344B74A80A1E7661E23CFE097B01BAFA5158BD5F5905C30DBA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-cojdk8-1.11.0-d32d9ed9e92938cf.jar
- Size 1KB
- SHA256 180d58cac512a1a3003b2f11085a81636792dc13fcf0b4859e6f502a93ab9ded
- MD5 b429752bf0a576e3186628bfd7eb31cb
- SHA1 8f394ef8c96ae12cddd2812e0fef4a4b4ad5ed57
- SHA512 6ef01232dedde1c9acf7c012e30e4584ada6f0afd842eef652d65adf27fd25044ea5760c72aa0645f4a13bdff04aa84c504fefa9468986dc01d0d94684e8972f
- TLSH T15D2179703FD8D52BD34E83B1CB53E1ABA2361169020D754F1B4CAC1847BDF496E059C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-dae-jvm-0.8.0-29674e5d8fb61b6d.jar
- Size 715KB
- SHA256 28cf54bf6dc8fd304249fea4b33ae10855e65fb4ef007c5acbbcf3dfa72f549e
- MD5 0e8369e0d1380ab4b401e482308fb2c4
- SHA1 911d057b281c6a7cd2008266e1eb60b0af3e40fc
- SHA512 c72f4e313f1003ce312dd0250a4575edc2230ebdc8892b1f347de27405c0580c7982a069b6d4f6c6a79f6c6879d2fb88a646f0ba7638750b2e65db1a1bdeb040
- SSDEEP 12288:6ilfLd2A3JEqmJNZqewWPELJWcTg/Nz7RdWWiX9kCJvdbmLW5S3c:6iZUcCjJjqeFPENWcOz7mWS9kcvBmLWL
- TLSH T162F4D036B994C959CD2341F0515170A6AF1AA3CFC6865117BCF20B462CF2D4EA33EBB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-ioe-jvm-0.9.0-cf1d42afe7996083.jar
- Size 151KB
- SHA256 2cf893217d01eaaf3e62e158168538e690e6f9821e404134bb5abea41b0ba6cf
- MD5 f2197d6af79e91989a56e1a3ee72abf1
- SHA1 6589227565f1286bc70ddd04a2a056f1130fe194
- SHA512 09e9450ee1401025c116ee2460deac6477e131ad59e3f2c14add78fe75834be436175f95348ba2f83ee23d3262ab0533c18566ecc27fd59d13219e22bc840b84
- SSDEEP 3072:GCGartbd7kLV/mrfBe04T3+22qjBH9ew3dxmjOu/YGskFqqzg/ZS:FGwb+Yrpw72oBH9eOmjv/TFqGx
- TLSH T1C5E3F136398CCA54E13378F34318D4FBB60B52CEE4A658176D910C4E37F8A8AD34AAD5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-iog-jvm-0.9.0-17ad2f282fb0c67b.jar
- Size 22KB
- SHA256 c635d8838929dc237836b12246b8b4d8a6bda4cc2ff53a683ed01ea231eddeb4
- MD5 a5209331e7d7b6d7f82ff490c0399a8f
- SHA1 76766b9de050b9c5901845d5834b083ce8f75ca2
- SHA512 a338c0a7d6a2f5b6f6ac7c83f9df5a213ce37f127fd01b8f65c3b6fb0883ba4c837ecb53415060000a17b5b7fc22ccb72d90ed825e5894b2cf3df0ea5f41dbe6
- SSDEEP 384:R+JaDOkuo0gsOWSwq26gxzx2RRiAanK7hv4xqesLGalfQwSlO5zPi2Q:R+J5Z7gs/Swz2RRd6al4wSl07it
- TLSH T16AA2BE193FE8C865F3A689F3D660B557B69220CDC1BE64A7CB80D8B72BB910503315E9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-se-jvm-1.11.0-52108abbd787b7f9.jar
- Size 399KB
- SHA256 61222d6d12fd1529db2bb810ce5bc8a222ea3371c98a556345c2fd258798baac
- MD5 da3954203dfc112095652355889e9797
- SHA1 311d0a637848e29566f48b647645d535ae534f7f
- SHA512 7a8c22fca7f0d92d76956721f6507a3f81387ab217265c48ae80434458ddfa19153c6d13d9637f61cff1f2362eb004243cd6ce2dfe1edba6b1773c5d47d24119
- SSDEEP 6144:dlqJKrae7aQ2hNnPhCgFPArG7q+RM0yzh7xejukQYeECPC+hc2HMO9mVpdv8yW:dltrqhVPhCqPB1fy7xezGCUbMO93
- TLSH T1DE94C06E7B84CE26CC23A4B34A20E06D743972CFD096A4D7B9A104A515F36C9D727F8D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-se-jvm-1.11.0-8b8e43b961e1ce7f.jar
- Size 289KB
- SHA256 a7f8870500369a34fc817965d79866f19934cddf7975d221e348f12bb377824e
- MD5 cb51ba029021334197592fa51d29e828
- SHA1 c32dae6558d63a7a4588e11d9c0c863fb1b34c5b
- SHA512 213b0240e61ae84fb387498e3852b4a622428417c6a7e2db2e5c09a7732e94be87a0d2572a214269280a26b672dd3cd998a1e34ff98208975f8795aa65cc9866
- SSDEEP 6144:qXUaUMFceWduNvbQCoESCdQ8c5XGg32oZoQo2qa6rg9tcvbBw0PUihoYu:+UaUkc5I7KY2VXnZoQo2L6rgrcqtiNu
- TLSH T15154DF6ABF848E43DD2F90F349189219343935CFC586A0CBBAD009A119F76CD9767B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_jetbrains_kotlinx_kotlinx-se-jvm-1.11.0-d7ffe353d5ab8d56.jar
- Size 70KB
- SHA256 cb0996e2d4f908c4ec8d26c768dc2276308cb164b84e41d0c95ec7a3930cd4f6
- MD5 7e87d328a499305293dc829413772abe
- SHA1 00d97ced343562977d42164a18a695f2069cb1b9
- SHA512 a7846e8efb432e1552d1d3dbecf8ffda66fcbe1a86da5ac75785e79e9fbefcf10fde74a50ccb503cbc9df9ef6582f2d219af7a2f05f7ee56ca3984231424e373
- SSDEEP 1536:GotujVHGZ73ZTe7UTI5SRQKZGbBAtbt043lXzU:GnjVHGZ73ZSgTI5SRQpct0EXzU
- TLSH T19563D0F97799CE56C827DAF14300E47E712E31CFC05218C3B9A69AD61AD65C98703F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_quiltmc_parsers_gson-0.2.1-dca73e94c7c97f1f.jar
- Size 4KB
- SHA256 a4ba4e7e59b327f3e2f52b0d4e6b3303bcad2cd02bae81e9641a6a989e39ed78
- MD5 31c4f0552232cd7f6d433a779ea222bd
- SHA1 02b8ce66d1b4f6456298d2edf311f9c873bd07ef
- SHA512 82196783a41bb7b7a56b4fde6804c9109aee071f312a627b3156ef4c41c8e064c3169209d10016ae874791d48d62d02d1defe84cf1ef0c93e11889ebb53e7d72
- SSDEEP 96:MJcVhzcVcfccOcrcTOIKSaK7DE2kbeqtuCx7cDBVI47OehJlETXefxNK0QH+ckgC:MyXoefBHQWv6DxWuJVJ7xhJlffxNK0Oo
- TLSH T17FA1E8B4E8C09457D34F27FEC7CDE303111E080ADA949BAF49002A76AD789489B8B8D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\org_quiltmc_parsers_json-0.2.1-f4450bb516755a53.jar
- Size 22KB
- SHA256 a39eaafba2b77855fd05797d1435ad2de0af0809cec59cdf369c6a140635caa5
- MD5 fd8e70e047066a4a471b065364442cde
- SHA1 541d707b4a69033b73797cc100d0c7eede91d055
- SHA512 bff62543499880ae7360e085013737ffd1143a29492bd5f5c51fcd2f6e37b0f74f531d5f76d4f59a65ef2487acf675d1cefd609e7b4615b45082d14d999b23ec
- SSDEEP 384:MXIjwCZeTaxu83uKkdFMD+TKoGyaSg8/baO05DiHDMdS/+TIcOQbI0ghc5OsSmw1:MYjwCZeTaM83kvUWggbaO0soxAQcer3M
- TLSH T1CFB2BE75D482A12AE53B3EFFCF55A7852015045E215EE72F8B10321D0CB1E6E06DFABA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\pride-1.7.0-beta.1+26.2-ba0f505f50d432e0.jar
- Size 42KB
- SHA256 cc4f1feb3b2ee412d57303e795cd9eef98765306c0e6c6f15286b80eda53684d
- MD5 abd5811bbcaea81a18e2f96986a586e4
- SHA1 e7f5643a1b190786aa0fe74ce3131b71a4213129
- SHA512 2762771e6b83f13376605d0d760f0c04a977f06d9f00e19abfb821e6d4ee4f516a5f5f0c4bdc80d51bfbda7d8a3ce365e49e56d03c2ae4d99754e52d1cf0c75f
- SSDEEP 768:80hdrgp4V5F8VinkATsmRtpmz0gKzz/ejocG8bT+1h7aHP1nwa2JjmLV9:80lx8ULTJto6ziSciGHNJ2JSLn
- TLSH T101138E5566E2EC07C97B6DF6C1825863E626991FF6F369AB243042F2C9B451C3F01AF0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\spruceui-11.0.0+26.2-eadc01e357b63c54.jar
- Size 251KB
- SHA256 e0a1841f56432d885cb965b487be4b0a89112cd47041efaa9a39b6ae19e10060
- MD5 aa5f0270c28a4427146377b242fcfe57
- SHA1 fb46e35bfa955ed3d8b4a2224746cd6a2435f9f7
- SHA512 a8ce1356129342c9e380a9d14e379e7ce2af0e915aa63b05f07fada1f0d11f318e52fabbbf9ce6d9fc933590f1f294a62b77b401b6e9caf4d2ba858abde2b1a9
- SSDEEP 3072:pLuD5lRaShBWVEuSetJmE8EsGr52fLMZnwRddKhSt5GIiz+DiDO+W3OKK3NqlZxc:Nw9zWEkcZExGmwghSt5Tizfw3OTNqXxc
- TLSH T16444AF7473A888E9C97BC879C0060C23ADC6438CE34669EF2577525D8DBE78C5F05EA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\yumi_commons_collections-2.0.0-f1ac559880dac129.jar
- Size 14KB
- SHA256 524294bab69b36dc029ded8470981bbd30fcfaffb8749954be905f8bfe07e182
- MD5 4430fcef1959b1f4b5c1820ade6138b4
- SHA1 f449d184673fd602bf371cb1efa81c751d17bee0
- SHA512 b183d92cbe73c1a5eba13511f70297fb89e770460f1df6f17ad1d18f10677c57a41e66f168b8d28a6c2e083263e7f2f050781d7e5fd0ad49cf9305786b61337c
- SSDEEP 384:trJCOH2/EYh2EEj/0LU9ZfUL++bPJGNnKkNLd9oY/srEy:7COg2EcyU9SVbsL3oYc
- TLSH T182627D21B2DBAB12C0F39F70A5F749A0B15A474D05CF20D73CA64743DAA99A91ED72C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\yumi_commons_core-2.0.0-dbd038ecbba59e42.jar
- Size 26KB
- SHA256 0dfbfa7852dabd778bbf5cc8fc960ea13f2853b15d451fca45f1a84b6ed4bbe2
- MD5 34b0a44f8703763766de9d221b376ddd
- SHA1 f5efa034fed033bf8cdc3c4c09a52d99d1b4772d
- SHA512 7473f152f091f62266e80eea43f511a347c0d412315e1930bc56f887485f422ffb27d21b01d1aa9f56e95e73794b0c6dfc0d3e163c15c99fcfe1141855092880
- SSDEEP 384:8HK/lm5raybJkfCrDl4LKLjl+vaN+zVarEPR8wJdBqzPJGNnKkNLd9oY/dC:8a8rZU03l+ck+Ep8MdBosL3oYo
- TLSH T1CCC2C0A5F4CBE570D4334A30E17B6689BC4723CD368D2AD711F1068369E6C6B5B82EE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\yumi_commons_event-2.0.0-896aeead44d8da84.jar
- Size 49KB
- SHA256 6c5a9c00ad20982ba63183c7ddcc8b388f677b2397aadfa664ce03f37737cb93
- MD5 b33232f12bb7ca18f24f6ca5ffb254d4
- SHA1 1e5b42131c6b9c08bbcfbb29e119e254ce0248cb
- SHA512 595a6b51f6c12ec5cf1b342a8389a34a25dce5c6fe993cee54db51f610cd277351f2692bace9d2accaeb32c77d065c5fd9193d46c2429d553fac13891fd9d773
- SSDEEP 768:3GBr4K+UWokke6l+H6CxxZdkfpPOQn3UDHwPjKQIE3REz4sL3oYowjIv:2h+lVkBl+HlzEfpuDu8E8L/e
- TLSH T13E33B07960CE4011F2734B34F1262012A82B5BCF7BCD2913A5F64DA758ABCAE8B077D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\.fabric\processedMods\yumi_mc_core-1.1.1+26.2-7501fb3f459f67b8.jar
- Size 184KB
- SHA256 606be7f1bf880c8fd40dfaada050e9b498330b3620c826ed21d743b12b368ad7
- MD5 d8e89020797e6f50b86a1cb39f694780
- SHA1 92684b98a993f656cab0ee0f8d8d389487841748
- SHA512 952c000024e0276cc84b07b30442d02b5e37b86d332bd966da19812a70ce5418cc51e45bd0cf0958fa3e3658ac94b391bf44681b5a7e002088eb593f415db0a1
- SSDEEP 3072:dXdZpjmhwBTJLaexMXAz0GX+WPMNDheS2KqQKNyBTLD7:dXdnKyBTsPGujmQKsRr
- TLSH T14004F0B079D88867CE3B2F72E5074993A56B925C4E0F210798B507C3CDB9B5A1F02AC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\config\BBEConfig.json
- Size 109B
- SHA256 e5f2ee57e9f9c0bd81af26c1918ceee988b3d726014c411f439406dc0fe60ef1
- MD5 3b7faae1eacd08e19276cdbd94ca7132
- SHA1 fbd464a04b876ca5a72107fd36bc49965c42ec31
- SHA512 0aa2643322380aedcd1bb989871a1c24555b477ff6d38c9ef553d12eab062f4e86ada16cec4cca21b1e76258736c682c9a843f0585d52f95aeeb505077ef05a8
- TLSH T1C2B012014C5A2A7F444206CCFDE01C0C156046D0B0A5D5E4B9E33ACE3D59E101733794
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\config\crash_assistant\config.toml
- Size 22KB
- SHA256 5413fb54d784c0d11ce9b91196a2de7391bd05563113baaf3b4b118ab05f457f
- MD5 48abbc44f24ced1522233dfeaadba699
- SHA1 e1ab847b325b8188b1d661ccb3a9d1d2d458b560
- SHA512 a1178ab82a4aa2544b87b245ad1811f6ca0777dd3f6d34110a81eca03dae53d85000a5e812b996423f11da15a66895193d965786b693602eb83477d166b14223
- SSDEEP 384:BMWlTlMcEjQt+ZQH0KD/zNuMHe+u0y5fshoslFLW2QtZxn59E:BMglMcuQt+ZK/zNFuNJshooFLW2QtZxU
- TLSH T125A2E959FE6D333A4E92D002AB7EC191F33500A91777B22E74AA81BC334085646BFDE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\config\entity_texture_features.json
- Size 1KB
- SHA256 406f923b1888b566e9d701ecb155e3ebf50f889074471e4b31d193d5f721cef9
- MD5 af1e3177018cac56478b46f48b724e92
- SHA1 cd850ddb30c9f013bde56e7fa5ed9298195d1002
- SHA512 7ebf43a594877d9cbaa49d666f095b3db3e27f9c66a817fc72c8050bb5c10c2a25f62ece902ff32cbcb7ad89fc5b67d3b032c9ebbe618bbd0b5583f819c73951
- TLSH T1F7215B95C07C54BA4AF5F41AFCFC52432E799D5216523CB9629B001D12CE72227F2AE3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\minecraft\mods\.index\entity-model-features.pw.toml
- Size 681B
- SHA256 737f92141b3e6450049ec544bbb0b45e084c4cabb2a4c0acb703faf04ca378dc
- MD5 29d3f704548c6d1413e579f02987a6e0
- SHA1 c68d75e4429258f842a0e7350b70d77fd54bd843
- SHA512 93b9e62214e748039a4714b89c66bfdfedbda811d451bad19a073a52257cfb2c3128d6517ec292434b6515858a893e89a036fe2b62f6dc5ba85444970fdb6929
- TLSH T15001FE0A57B3D037092BDB72E9EC4A7A8B65477A9F325870A8E401A805CE81F721D0C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\instances\Fabulously Optimized\mmc-pack.json
- Size 1KB
- SHA256 d9a9110f87d34343834ec0cc055f75a60893f6563f6abe3500d13e6d39226215
- MD5 66992de69398ca16a3e310fb0ff4ce79
- SHA1 a5b9f779e242a1bf3635aaac9e06f558515652b2
- SHA512 0e96bb09083b224adf6c46c30dac36c962a4195c94b60fb0c5cdee718401b101fa070d065f154337f3dfa8ba86e4a121c070c2b954a599e56216a62d5fd581eb
- TLSH T197212334C3F21C7334659370483A41A6963044176F603FEDB61C810C0F5E6AEA5A62BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\legal\java.logging\ADDITIONAL_LICENSE_INFO
- Size 48B
- SHA256 d255311b0a181e243de326d111502a8b1dc7277b534a295a8340ab5230e74c83
- MD5 512f151af02b6bd258428b784b457531
- SHA1 84d2102ad171863db04e7ee22a259d1f6c5de4a5
- SHA512 1a305bc333c7c2055a334dc67734db587fd6fda457b46c8df8f17ded0a8982e3830970bee75cc17274aa0a4082f32792b5dbff88410fa43cc61b55c1dce4c129
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\legal\java.logging\ASSEMBLY_EXCEPTION
- Size 43B
- SHA256 7901499314e881a978d80a31970f0daec92d4995f3305e31fb53c38d9cc6ec3b
- MD5 bd468da51b15a9f09778545b00265f34
- SHA1 c80e4bab46e34d02826eab226a4441d0970f2aba
- SHA512 2c1d43c3e17bb2fca24a77bea3d2b3954a47da92e0cdd0738509bffcdbe2935c11764cd5af50439061638bba8b8d59da29e97ea7404ea605f7575fc13395ca93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\java\java-runtime-epsilon\legal\java.logging\LICENSE
- Size 32B
- SHA256 d60635c89c9f352ae1e66ef414344f290f5b5f7ce5c23d9633d41fde0909df80
- MD5 663f71c746cc2002aa53b066b06c88ab
- SHA1 12976a6c2b227cbac58969c1455444596c894656
- SHA512 507b7d09d3bcd9a24f0b4eeda67167595ac6ad37cd19fb31cd8f5ce8466826840c582cb5dc012a4bd51b55e01bb551e207e9da9e0d51948e89f962ba09606aab
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 136B
- SHA256 ba5bcae132316fce22bc2dfee40ce53c7c9098701744d7ce5836e7478c0c0273
- MD5 a214520741df8f7fff388906f1e69700
- SHA1 379e88003082910edea676067e88bff812a83331
- SHA512 ced33029d986ba9ec436c84a30958a930f9d08f99e5f6e2708b04127ab3cb87e1036b72e3501260671ac2b2f90bcd06665050732cd1d08637388a76d635f7d59
- TLSH T16EC02B43C02070F1137332149442CD80CA1723082A090074F4C37C8633078901712C90
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 30B
- SHA256 e7bb8d933ad3397d35cf1706f0364ebab6b7c73b6b6846cdb0383db420c2cb25
- MD5 412c51abbdcc110394940f8bfdee3d3f
- SHA1 17df4e8360e0b635622dd12a6a36088cbb47b2ad
- SHA512 77b3d41680d77ed7a29b3d0e1d07583bd1a29d0c3939f0eebb17639cf2e92447fc5eb784635d0b44ae0b58a5212b4d9ca6505a02d0d2c9a521089a8b33437440
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 93B
- SHA256 3d66da6fa83007ff0c1e7901840eca8a6b33725d4daf8972160546cd9c71c63f
- MD5 485b28b519d859d2ec1bafcfc46ea557
- SHA1 b68da94309b7eab6004c2ea4d4e4503514a41df5
- SHA512 e174bf37861dccff7b4f7964200c1b9e77c059ad2e9649051e95411dbd0d49649384a4dc76aa89d3266e9463f0f2d74f40a28b45054f8670656df2768866b581
- TLSH T1DBB01243810160610B9372039001CCC0C52313451D150468B486BC8533038440F53DA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 52B
- SHA256 a85a9d50bb071347303a46f4136a1c7cce8bd90981cc0827ff197039297f27ee
- MD5 8aac2bd026fcb2d8fc2f6a7f45cbcbbb
- SHA1 667e2b2fd911eb529aea7acd6fb8f8ccf0dbe618
- SHA512 a4e65cd70986ed3978d774a1cdeb849ff8c4d024b19785946e07638aecc2bf00782036fc353bb88bb81296bb59c954a892324cabb38ee46d5ba4b8beeb48673e
- TLSH T1B09002078100A0760563274580118C449A6113416519456D78D9A98673059541997C64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 542B
- SHA256 0cf2cf1b50a8aa3d5d6e88484023e1ed5fbeab4c5386093d0441ee64e2c73dce
- MD5 35be31070d0048193494b21604a47e1d
- SHA1 8bf164ea6c7076f78207f75c2e098cc0aa66a4cc
- SHA512 afe03b2f0ea5cf43e87bd153b60023342c9f949466c544662aed964f796cd29bac15a9d7a7c3982b05712637f27f965d0778eab1cd227411d26581d64cd33b5b
- TLSH T150F00573A740A0B5F9E22FC554425ECADEC77A43D5841189F0897A5FE3D09589350AE2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 480B
- SHA256 6845ddc37b1813a0dcfa4b02083ca9f5b4cf158f718af2503f08619828862404
- MD5 f0354b5688e26546f2145c4d4d34900b
- SHA1 0f474479ead222c046d6330030fbd0c3c92675b1
- SHA512 a7b7f45e0403960f1159774e8f2dc97ed193dec26699cdfa9d940c8a791a9400843668085cd4903c80c315219b419ea9d6fc09cae7ce495756d6dbf9f00d8e80
- TLSH T1FDF0DC335390E036F9AA5FC894426E8AEE432E43CE8410CDB4497E4FE3909085381AE2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg
- Size 414B
- SHA256 527596cfccf178094e125268891a14425fc608213e4cdace641941959e4b99b9
- MD5 46ec1887862da03756a528d34a86f6b0
- SHA1 bd6cdd6aa59bc85d454a38216862a159d2b45d25
- SHA512 ed2ffebc77229f9caf77b0189e95c65b895193835f59ed434c14ee737f862e36a369fb2f19ba9fe3ffe5c7865552786a79d4f0a2a19b56335af6505805c61591
- TLSH T1E2E0F1732600E036FD696FC5A4435C46CE437E43DFC910C9B0497F9F636161897818C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PrismLauncher\prismlauncher.cfg.lock
- Size 66B
- SHA256 90fdc92264eb943ae798159ea4a6b784eb7c0a23d86bf3c59a95b53505cc4daf
- MD5 1c1bdaf8be0b0591160146cc9d043c5f
- SHA1 bea7eb6f8b3126da3bb90f7efdab2f14786efeb7
- SHA512 3964beecbf6ab255c5076293452c7a757eaba4de058aad61b56490c622bf7b172cf50eac4fdb3e2744e689a2199d03d2ef4ac9a0048b73828f788b218b439516
- TLSH T105A0220F0E3C3202820C0883200CA2B2C0F00000002202208C200EBA82BE3383A20EA0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Downloads\PrismLauncher-Windows-MSVC-Setup-11.0.2.exe.crdownload
- Size 22.9MB
- SHA256 f747a500d5f320f03e6d586b7b02a2ad9b4e20e9e3c049560653921e5ed0e7e6
- MD5 c9e517768e6f765d72bce0bfa55d5540
- SHA1 0a578425ed863b4d0b971a90331ea4ae2d3aecac
- SHA512 d5703c2a7b5c4b5aa416f987ac2bf6e5e4759619b0d96a0d0c9e583a259c649c31552a96f6cd81486d974df3944f17cbde3d15a2a078822e6fe3a2948ce5b694
- SSDEEP 393216:+bKjTvdjxZcD3Oj/6E2aHd/08sNkkdgxe6Vzu/cUGRoPeN2L3vaqNACcspokbGrs:+YTtmLE1SbNVKxe/8qg2mCcsaiPGAgdg
- TLSH T1323723DE73740044C18E0F749A9A51C0790E6D6727F0E87BEA76F4CAACB4ACA45DE91C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\Unconfirmed 779960.crdownload
- Size 2.3MB
- SHA256 fea4ff0366edcfe931613d790194bc99e0acb78a7de4baac8698bb5ef9b69865
- MD5 ec7a41aca86a0f430f006774dee22e5a
- SHA1 bbd3bc83916cd44cbfb006d687e29bb6500e580e
- SHA512 6be3a5bd61fde417a137b7237687b25bf2a39d0860585501bd10eb6ccf2bd214f885b1963c03073e61b2011b5d1318d3d4c9394fe60356debb26da28fd495ff1
- SSDEEP 49152:uwZbeAHOz9CFIW4pfBBCbJyq8mdepUfkptVxXkuQXKeRi:JZCAHOzIz4pJdpUu5T
- TLSH T188B58D12B6D98032F1B316319DB9C6589674B8A64B3684DFB3CC165E9F709C18B36F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Videos\Captures\desktop.ini
- Size 190B
- SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
- MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
- SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
- SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
- TLSH T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\MSI5350.tmp
- Size 866KB
- SHA256 749a4a26c3f3742275b7087e6c1ee2abc1baaeed1e74c20a11ba52da534cb15c
- MD5 a1291fa01b42ef3be1e1b5afbe4fb70e
- SHA1 0d0de1dbee10ddb82b1206b829ff799e96bf6ab9
- SHA512 2d19ca207a947232a0c430c959130d82d99f11ede9bd39cafe0d05d733f20881e29ac4a4fd8dfa8f2a2e953d1c9ab83a0e770104a6cc4273e839ce08b9c6f3e8
- SSDEEP 12288:EXdInHD5K0PjtUNFflQ6sxwczRGB+1DnOIy10OzPEdBhI33ljzVKxr6cvM/2X5HM:yKpzRGunZI33ljzd/85RkveioTAv
- TLSH T182158D2176D58076F1BF1B31A97887684E79BCB24E75C58F63C4257E1EB1A81CB20B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8860.tmp
- Size 269KB
- SHA256 a7d7b98449549710b359dcacb41642e26e9d79523fb1507860ba2ed4b314ef89
- MD5 4367508c0a612115c8d15c92b6ccec0c
- SHA1 cf19b8fd08d65af94f519e71b7976d3699ef1cd5
- SHA512 291a111cdd47182421786dec45a9cf08d10fdf2328afff60920f16eeaf8ee84e0c4c6fb2c04ab215e28473e5e4adca4ecfc80cba277dcd351797838e410d737c
- SSDEEP 6144:3fL5HqSsYVIBkn8HMt+w4N+EMblQPpAOItkyBgsykeD:o7YVqkn8HI405QBJymsykeD
- TLSH T1B044AE1179C1C833D9BF12350529D7A45A7DB5704BB1C8ABA3D81E6E8F321C2DF31AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI8BFE.tmp
- Size 279KB
- SHA256 bf251a729726dbbc46b20ebe2465d382fbb732ecbcdd16f4c6ea4d555701f77e
- MD5 352713d0832102d6a318e59a92d7400c
- SHA1 108ec4ce2cf4cec9510a3fc6e55806fb66ed06f7
- SHA512 10acbabf7faa61d7e5ff0c65da1f39d6f1c993ff332cbe01c9c97a6b1148995bfa3dc6f8fd7eb104ec8d8787525abf55fd5a145cfb30c0ccf6656216d800d7c7
- SSDEEP 6144:BYATSQSwDVp43gQ3eVoIOCSomurCw9YsYAq1zGMIVz:BTWQhOgQwo00w9pYAXMS
- TLSH T19A54AF217991C037DA6F0A345439C7688E7DB8A14FB0E5C7A3C41DAA8E726C1DF35A4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{04035DB3-336F-49E3-B0B0-0675EBA7B4F7}\.cr\vc_redist.x64.exe
- Size 670KB
- SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
- MD5 bc9c8a6a42e8d3ea18f8da78d5031820
- SHA1 07812a4b945364d04627363e46ab38de188281b3
- SHA512 b583f41b8f9cbb2b04e4c7403b54241bf4c51caefdb0bbe9184202dc615f599b496d65f6d36984b75f9b9003289c0c13066dc1e6eb294f9139248595114b4f73
- SSDEEP 12288:n3mgqnIZuYfCYqFet4CovkM7x61nE4rfDDIcbMZ3Mya:n3WnIZuMCxezot7MhbfDBMZ8ya
- TLSH T10DE49E32A5604033F7F10573B928A6303E7CE3282B51C9A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
- Size 5.4MB
- SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
- MD5 ea81447ef1038bd5726b36063896b39a
- SHA1 8f484a24bfe42276580d120c200a99bf604eea70
- SHA512 31fe32db60d9a0579374ce3a51b586ef0fa7b891aebcd33613a818264bb9eeccba4f2b5ac4b95feca144d4be6146e99d9f5dfa7bfa5e11cfae46e06b41da251f
- SSDEEP 98304:JnfKe/OhMAf7WUHioDNe/rdRlRFQdU8o2VDF/ZXZsHOtnF9r:hPAzWxZgU85VDbXZs+z
- TLSH T17D4633018111941B63BB250753FCF1518FF2F087A4B672BA3BD2934E4AE78CF59EA51A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\cab5046A8AB272BF37297BB7928664C9503
- Size 964KB
- SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
- MD5 efc41c00aadf8b2050ecf9e38e9036f1
- SHA1 bc4afc5cb90411f0e4e874372f1fbabab0cfd33d
- SHA512 bc9cc1e83acc8dbe53501ca4554dec6d31cb0ccd3609d0e760c7fdbf73fbc4c46baf14c397667eaeced284506d0a9a0bdf7777736f05ae277e9e2f3349371136
- SSDEEP 24576:+e9fUQD6DozFBvW8lRBAaKycdSCTbiVTPf1eg++4:+exUQX/e8lzAjdZTbiVTnw
- TLSH T15625338685244AC1694EEC06B346F9BF74D331FD59B5B8032A262EC8E3D33857593937
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\vcRuntimeAdditional_x64
- Size 208KB
- SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
- MD5 f375f3d81a661e188146d701d8ed3ba9
- SHA1 0851e6da56fa65981ae27d9eb7e396afe1ea0c73
- SHA512 d67709e2f25ad12532ed33d26c0ae365b7a4eb0e6711b2ee7dda489480b9976b4bbfd0b902cbb847cb602922a1653a2981741718fdec4091ae25f07fe5b8bf2a
- SSDEEP 3072:F9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT6qF:/laZeKFxCnBheIdlu2q
- TLSH T19E24AE12B5808033DAFE1A311178DB615F3D7E608F544A9B6364B6AD1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{7352F928-86EC-497C-ABE9-8C721D9A9404}\vcRuntimeMinimum_x64
- Size 208KB
- SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
- MD5 23626831f9a05572c6ebd133e5ffc4b0
- SHA1 ad044cdf938a5532aa270c6bc687db95d803fe10
- SHA512 1b45ea55e7278ec61f0689b70794f371d56eb2787c22106ebec38d17f1670441a853849460249d08380053bc8b2fae0285845b47ad62670029639d5de5ace10c
- SSDEEP 3072:o9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTA:+laZeKFxCnBheIdlu
- TLSH T1A3249E12B5808033DAFE1A311578DB615F3D7E608F54899B6364B6AC1E717C08F3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ED0E6D46-73ED-4F61-AD34-F6AFD11014A0}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ED0E6D46-73ED-4F61-AD34-F6AFD11014A0}\.ba\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{ED0E6D46-73ED-4F61-AD34-F6AFD11014A0}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{ED0E6D46-73ED-4F61-AD34-F6AFD11014A0}\.ba\wixstdba.dll
- Size 191KB
- SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
- MD5 eab9caf4277829abdf6223ec1efa0edd
- SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
- SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
- SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
- TLSH T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
- MD5 SHA1 SHA512 SSDEEP TLSH